[linux-merge]linux integration; branch, ecsv/merge_test, created. v4.6-rc6-1420-g26d43e8 - commits - lists.open-mesh.org

3 May 2016


      The branch, ecsv/merge_test has been created
        at  26d43e8ed9bbab4d4c61528e0255df5c5e48c6f8 (commit)
- Shortlog ------------------------------------------------------------
commit 26d43e8ed9bbab4d4c61528e0255df5c5e48c6f8
Author: Sven Eckelmann sven@narfation.org
Date:   Mon Feb 22 22:56:33 2016 +0100
batman-adv: Fix unexpected free of bcast_own on add_if error
The function batadv_iv_ogm_orig_add_if allocates new buffers for bcast_own
    and bcast_own_sum. It is expected that these buffers are unchanged in case
    either bcast_own or bcast_own_sum couldn't be resized.
But the error handling of this function frees the already resized buffer
    for bcast_own when the allocation of the new bcast_own_sum buffer failed.
    This will lead to an invalid memory access when some code will try to
    access bcast_own.
Instead the resized new bcast_own buffer has to be kept. This will not lead
    to problems because the size of the buffer was only increased and therefore
    no user of the buffer will try to access bytes outside of the new buffer.
Fixes: fdafa7d29ace ("batman-adv: provide orig_node routing API")
    Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 195f9d603b4b51f77b56c005206587d866af7475
Author: Antonio Quartulli a@unstable.cc
Date:   Mon May 2 18:27:38 2016 +0800
batman-adv: make sure ELP/OGM orig MAC is updated on address change
When the MAC address of the primary interface is changed,
    update the originator address in the ELP and OGM skb buffers as
    well in order to reflect the change.
Fixes: a4b88af77e28 ("batman-adv: ELP - adding basic infrastructure")
    Reported-by: Marek Lindner marek@neomailbox.ch
    Signed-off-by: Antonio Quartulli a@unstable.cc
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 42a92f93e6d9a6ee065f551cba8c51b028d78fdf
Author: Linus Lüssing linus.luessing@c0d3.blue
Date:   Thu Jan 7 08:11:12 2016 +0100
batman-adv: Avoid duplicate neigh_node additions
Two parallel calls to batadv_neigh_node_new() might race for creating
    and adding the same neig_node. Fix this by including the check for any
    already existing, identical neigh_node within the spin-lock.
This fixes splats like the following:
[  739.535069] ------------[ cut here ]------------
    [  739.535079] WARNING: CPU: 0 PID: 0 at /usr/src/batman-adv/git/batman-adv/net/batman-adv/bat_iv_ogm.c:1004 batadv_iv_ogm_process_per_outif+0xe3f/0xe60 [batman_adv]()
    [  739.535092] too many matching neigh_nodes
    [  739.535094] Modules linked in: dm_mod tun ip6table_filter ip6table_mangle ip6table_nat nf_nat_ipv6 ip6_tables xt_nat iptable_nat nf_nat_ipv4 nf_nat xt_TCPMSS xt_mark iptable_mangle xt_tcpudp xt_conntrack iptable_filter ip_tables x_tables ip_gre ip_tunnel gre bridge stp llc thermal_sys kvm_intel kvm crct10dif_pclmul crc32_pclmul sha256_ssse3 sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd evdev pcspkr ip6_gre ip6_tunnel tunnel6 batman_adv(O) libcrc32c nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack autofs4 ext4 crc16 mbcache jbd2 xen_netfront xen_blkfront crc32c_intel
    [  739.535177] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W  O    4.2.0-0.bpo.1-amd64 #1 Debian 4.2.6-3~bpo8+2
    [  739.535186]  0000000000000000 ffffffffa013b050 ffffffff81554521 ffff88007d003c18
    [  739.535201]  ffffffff8106fa01 0000000000000000 ffff8800047a087a ffff880079c3a000
    [  739.735602]  ffff88007b82bf40 ffff88007bc2d1c0 ffffffff8106fa7a ffffffffa013aa8e
    [  739.735624] Call Trace:
    [  739.735639]  <IRQ>  [<ffffffff81554521>] ? dump_stack+0x40/0x50
    [  739.735677]  [<ffffffff8106fa01>] ? warn_slowpath_common+0x81/0xb0
    [  739.735692]  [<ffffffff8106fa7a>] ? warn_slowpath_fmt+0x4a/0x50
    [  739.735715]  [<ffffffffa012448f>] ? batadv_iv_ogm_process_per_outif+0xe3f/0xe60 [batman_adv]
    [  739.735740]  [<ffffffffa0124813>] ? batadv_iv_ogm_receive+0x363/0x380 [batman_adv]
    [  739.735762]  [<ffffffffa0124813>] ? batadv_iv_ogm_receive+0x363/0x380 [batman_adv]
    [  739.735783]  [<ffffffff810b0841>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
    [  739.735804]  [<ffffffffa012cb39>] ? batadv_batman_skb_recv+0xc9/0x110 [batman_adv]
    [  739.735825]  [<ffffffff81464891>] ? __netif_receive_skb_core+0x841/0x9a0
    [  739.735838]  [<ffffffff810b0841>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
    [  739.735853]  [<ffffffff81465681>] ? process_backlog+0xa1/0x140
    [  739.735864]  [<ffffffff81464f1a>] ? net_rx_action+0x20a/0x320
    [  739.735878]  [<ffffffff81073aa7>] ? __do_softirq+0x107/0x270
    [  739.735891]  [<ffffffff81073d82>] ? irq_exit+0x92/0xa0
    [  739.735905]  [<ffffffff8137e0d1>] ? xen_evtchn_do_upcall+0x31/0x40
    [  739.735924]  [<ffffffff8155b8fe>] ? xen_do_hypervisor_callback+0x1e/0x40
    [  739.735939]  <EOI>  [<ffffffff810013aa>] ? xen_hypercall_sched_op+0xa/0x20
    [  739.735965]  [<ffffffff810013aa>] ? xen_hypercall_sched_op+0xa/0x20
    [  739.735979]  [<ffffffff8100a39c>] ? xen_safe_halt+0xc/0x20
    [  739.735991]  [<ffffffff8101da6c>] ? default_idle+0x1c/0xa0
    [  739.736004]  [<ffffffff810abf6b>] ? cpu_startup_entry+0x2eb/0x350
    [  739.736019]  [<ffffffff81b2af5e>] ? start_kernel+0x480/0x48b
    [  739.736032]  [<ffffffff81b2d116>] ? xen_start_kernel+0x507/0x511
    [  739.736048] ---[ end trace c106bb901244bc8c ]---
Reported-by: Martin Weinelt martin@darmstadt.freifunk.net
    Signed-off-by: Linus Lüssing linus.luessing@c0d3.blue
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit aa1fdfb9f41d298f4ee9347d5e5c02eadc0cb906
Author: Antonio Quartulli a@unstable.cc
Date:   Fri Mar 11 14:01:10 2016 +0100
batman-adv: use batadv_compare_eth when possible
When comparing Ethernet address it is better to use the more
    generic batadv_compare_eth. The latter is also optimised for
    architectures having a fast unaligned access.
Signed-off-by: Antonio Quartulli a@unstable.cc
    [sven@narfation.org: fix conflicts with current version]
    Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit a9bdc61f2d1c4333cf8b299179ab784aa5cabd38
Author: Marek Lindner mareklindner@neomailbox.ch
Date:   Sun Mar 20 18:39:56 2016 +0800
batman-adv: replace ethertype variable with ETH_P_BATMAN for readability
Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
    Reviewed-by: Sven Eckelmann sven@narfation.org
commit 44c11d8174c1364ba16ea6569337b204a4361007
Author: Sven Eckelmann sven@narfation.org
Date:   Mon Feb 22 21:02:39 2016 +0100
batman-adv: Use bool as return type for boolean functions
It is easier to understand that the returned value of a specific function
    doesn't have to be 0 when the functions was successful when the actual
    return type is bool. This is especially true when all surrounding functions
    with return type int use negative values to return the error code.
Reported-by: Nicholas Krause xerofoify@gmail.com
    Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 5e3d2dd0a55684eff68e53734037adfd50ee4767
Author: Sven Eckelmann sven.eckelmann@open-mesh.com
Date:   Tue Feb 16 10:47:07 2016 +0100
batman-adv: Fix integer overflow in batadv_iv_ogm_calc_tq
The undefined behavior sanatizer detected an signed integer overflow in a
    setup with near perfect link quality
UBSAN: Undefined behaviour in net/batman-adv/bat_iv_ogm.c:1246:25
        signed integer overflow:
        8713350 * 255 cannot be represented in type 'int'
The problems happens because the calculation of mixed unsigned and signed
    integers resulted in an integer multiplication.
batadv_ogm_packet::tq (u8 255)
        * tq_own (u8 255)
        * tq_asym_penalty (int 134; max 255)
        * tq_iface_penalty (int 255; max 255)
The tq_iface_penalty, tq_asym_penalty and inv_asym_penalty can just be
    changed to unsigned int because they are not expected to become negative.
Fixes: 46e44fdb96ef ("batman-adv: add WiFi penalty")
    Signed-off-by: Sven Eckelmann sven.eckelmann@open-mesh.com
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 22b2f12b0285f943064fb3d50b1abdf14f2baedc
Author: Sven Eckelmann sven@narfation.org
Date:   Sat Mar 5 19:05:24 2016 +0100
batman-adv: Use kref_get for _batadv_update_route
_batadv_update_route requires that the caller already has a valid reference
    for neigh_node. It is therefore not possible that it has an reference
    counter of 0 and was still given to this function
The kref_get function instead WARNs (with debug information) when the
    reference counter would still be 0. This makes a bug in batman-adv better
    visible because kref_get_unless_zero would have ignored this problem.
Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 03e296ede1b69faf66427f966ebc9f658ae4603c
Author: Sven Eckelmann sven@narfation.org
Date:   Mon Apr 11 13:06:40 2016 +0200
batman-adv: Use kref_get for hard_iface subfunctions
The callers of the functions using batadv_hard_iface objects already make
    sure that they hold a valid reference. The subfunctions don't have
    to check whether the reference counter is > 0 because this was checked by
    the callers.
The kref_get function instead WARNs (with debug information) when the
    reference counter would still be 0. This makes a bug in batman-adv better
    visible because kref_get_unless_zero would have ignored this problem.
Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 832378fe09bc4537018f16c0340629491396193d
Author: Sven Eckelmann sven@narfation.org
Date:   Sat Mar 5 16:09:23 2016 +0100
batman-adv: Use kref_get for batadv_gw_node_add
batadv_gw_node_add requires that the caller already has a valid reference
    for orig_node. It is therefore not possible that it has an reference
    counter of 0 and was still given to this function
The kref_get function instead WARNs (with debug information) when the
    reference counter would still be 0. This makes a bug in batman-adv better
    visible because kref_get_unless_zero would have ignored this problem.
Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 98b9d949a822aa861463c5a0001f50c53539f164
Author: Sven Eckelmann sven@narfation.org
Date:   Sat Mar 5 16:09:22 2016 +0100
batman-adv: Use kref_get for batadv_gw_select
batadv_gw_select requires that the caller already has a valid reference for
    new_gw_node. It is therefore not possible that it has an reference counter
    of 0 and was still given to this function
The kref_get function instead WARNs (with debug information) when the
    reference counter would still be 0. This makes a bug in batman-adv better
    visible because kref_get_unless_zero would have ignored this problem.
Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 201e5250a1124f3f82919c9681f5d7d8ecb9833a
Author: Sven Eckelmann sven@narfation.org
Date:   Sat Mar 5 16:09:21 2016 +0100
batman-adv: Use kref_get for batadv_nc_get_nc_node
batadv_nc_get_nc_node requires that the caller already has a valid
    reference for orig_neigh_node. It is therefore not possible that it has an
    reference counter of 0 and was still given to this function
The kref_get function instead WARNs (with debug information) when the
    reference counter would still be 0. This makes a bug in batman-adv better
    visible because kref_get_unless_zero would have ignored this problem.
Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 3b59ba0b115c75f5908a41dd23c9b70fa9682919
Author: Sven Eckelmann sven@narfation.org
Date:   Sat Mar 5 16:09:20 2016 +0100
batman-adv: Use kref_get for batadv_tvlv_container_get
batadv_tvlv_container_get requires that tvlv.container_list_lock is held by
    the caller. It is therefore not possible that an item in
    tvlv.container_list has an reference counter of 0 and is still in the list
The kref_get function instead WARNs (with debug information) when the
    reference counter would still be 0. This makes a bug in batman-adv better
    visible because kref_get_unless_zero would have ignored this problem.
Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 2ccb0f4f1967024a5d36e45f294251228fa6aa3f
Author: Sven Eckelmann sven@narfation.org
Date:   Sat Mar 5 16:09:18 2016 +0100
batman-adv: Increase hard_iface refcnt for ptype
The hard_iface is referenced in the packet_type for batman-adv. Increase
    the refcounter of the hard_interface for it to have an explicit reference
    for it in case this functionality gets refactorted and the currently
    used implicit reference for it will be removed.
Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit 7c659f25def88eeffb66944597868a7447aad1bb
Author: Sven Eckelmann sven@narfation.org
Date:   Sat Mar 5 16:09:17 2016 +0100
batman-adv: Check hard_iface refcnt when receiving skb
The receive function may start processing an incoming packet while the
    hard_iface is shut down in a different context. All called functions called
    with the batadv_hard_iface object belonging to the incoming interface would
    have to check whether the reference counter is still > 0.
This is rather error-prone because this check can be forgotten easily.
    Instead check the reference counter when receiving the object to make sure
    that all called functions have a valid reference.
Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit bcd6896b7e49226daf97c0a75e8bc8f3968ea167
Author: Sven Eckelmann sven@narfation.org
Date:   Sat Mar 5 16:09:16 2016 +0100
batman-adv: Check hard_iface refcnt before calling function
The batadv_hardif_list list is checked in many situations and the items
    in this list are given to specialized functions to modify the routing
    behavior. At the moment each of these called functions has to check
    itself whether the received batadv_hard_iface has a refcount > 0 before
    it can increase the reference counter and use it in other objects.
This can easily lead to problems because it is not easily visible where
    all callers of a function got the batadv_hard_iface object from and
    whether they already hold a valid reference.
Checking the reference counter directly before calling a subfunction
    with a pointer from the batadv_hardif_list avoids this problem.
Signed-off-by: Sven Eckelmann sven@narfation.org
    Signed-off-by: Marek Lindner mareklindner@neomailbox.ch
commit fed1648cb48c0a5ab551774fafdd5bb5f4508a18
Merge: eb8e8bb5 6071bd1
Author: Sven Eckelmann sven@narfation.org
Date:   Tue May 3 22:20:59 2016 +0200
Merge remote-tracking branch 'net/master' into ecsv/merge_test
Unsolved Conflicts:
    	net/ipv4/ip_gre.c
commit 6071bd1aa13ed9e41824bafad845b7b7f4df5cfd
Author: Neil Horman nhorman@tuxdriver.com
Date:   Mon May 2 12:20:15 2016 -0400
netem: Segment GSO packets on enqueue
This was recently reported to me, and reproduced on the latest net kernel,
    when attempting to run netperf from a host that had a netem qdisc attached
    to the egress interface:
[  788.073771] ---------------------[ cut here ]---------------------------
    [  788.096716] WARNING: at net/core/dev.c:2253 skb_warn_bad_offload+0xcd/0xda()
    [  788.129521] bnx2: caps=(0x00000001801949b3, 0x0000000000000000) len=2962
    data_len=0 gso_size=1448 gso_type=1 ip_summed=3
    [  788.182150] Modules linked in: sch_netem kvm_amd kvm crc32_pclmul ipmi_ssif
    ghash_clmulni_intel sp5100_tco amd64_edac_mod aesni_intel lrw gf128mul
    glue_helper ablk_helper edac_mce_amd cryptd pcspkr sg edac_core hpilo ipmi_si
    i2c_piix4 k10temp fam15h_power hpwdt ipmi_msghandler shpchp acpi_power_meter
    pcc_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c
    sd_mod crc_t10dif crct10dif_generic mgag200 syscopyarea sysfillrect sysimgblt
    i2c_algo_bit drm_kms_helper ahci ata_generic pata_acpi ttm libahci
    crct10dif_pclmul pata_atiixp tg3 libata crct10dif_common drm crc32c_intel ptp
    serio_raw bnx2 r8169 hpsa pps_core i2c_core mii dm_mirror dm_region_hash dm_log
    dm_mod
    [  788.465294] CPU: 16 PID: 0 Comm: swapper/16 Tainted: G        W
    ------------   3.10.0-327.el7.x86_64 #1
    [  788.511521] Hardware name: HP ProLiant DL385p Gen8, BIOS A28 12/17/2012
    [  788.542260]  ffff880437c036b8 f7afc56532a53db9 ffff880437c03670
    ffffffff816351f1
    [  788.576332]  ffff880437c036a8 ffffffff8107b200 ffff880633e74200
    ffff880231674000
    [  788.611943]  0000000000000001 0000000000000003 0000000000000000
    ffff880437c03710
    [  788.647241] Call Trace:
    [  788.658817]  <IRQ>  [<ffffffff816351f1>] dump_stack+0x19/0x1b
    [  788.686193]  [<ffffffff8107b200>] warn_slowpath_common+0x70/0xb0
    [  788.713803]  [<ffffffff8107b29c>] warn_slowpath_fmt+0x5c/0x80
    [  788.741314]  [<ffffffff812f92f3>] ? ___ratelimit+0x93/0x100
    [  788.767018]  [<ffffffff81637f49>] skb_warn_bad_offload+0xcd/0xda
    [  788.796117]  [<ffffffff8152950c>] skb_checksum_help+0x17c/0x190
    [  788.823392]  [<ffffffffa01463a1>] netem_enqueue+0x741/0x7c0 [sch_netem]
    [  788.854487]  [<ffffffff8152cb58>] dev_queue_xmit+0x2a8/0x570
    [  788.880870]  [<ffffffff8156ae1d>] ip_finish_output+0x53d/0x7d0
    ...
The problem occurs because netem is not prepared to handle GSO packets (as it
    uses skb_checksum_help in its enqueue path, which cannot manipulate these
    frames).
The solution I think is to simply segment the skb in a simmilar fashion to the
    way we do in __dev_queue_xmit (via validate_xmit_skb), with some minor changes.
    When we decide to corrupt an skb, if the frame is GSO, we segment it, corrupt
    the first segment, and enqueue the remaining ones.
tested successfully by myself on the latest net kernel, to which this applies
Signed-off-by: Neil Horman nhorman@tuxdriver.com
    CC: Jamal Hadi Salim jhs@mojatatu.com
    CC: "David S. Miller" davem@davemloft.net
    CC: netem@lists.linux-foundation.org
    CC: eric.dumazet@gmail.com
    CC: stephen@networkplumber.org
    Acked-by: Eric Dumazet edumazet@google.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit 9b40d5aaef542f5b2bcba41fb1e24cfcba793774
Merge: 33656a1 abe59c6
Author: David S. Miller davem@davemloft.net
Date:   Tue May 3 00:17:38 2016 -0400
Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge
Antonio Quartulli says:
====================
    In this small batch of patches you have:
    - a fix for our Distributed ARP Table that makes sure that the input
      provided to the hash function during a query is the same as the one
      provided during an insert (so to prevent false negatives), by Antonio
      Quartulli
    - a fix for our new protocol implementation B.A.T.M.A.N. V that ensures
      that a hard interface is properly re-activated when it is brought down
      and then up again, by Antonio Quartulli
    - two fixes respectively to the reference counting of the tt_local_entry
      and neigh_node objects, by Sven Eckelmann. Such bug is rather severe
      as it would prevent the netdev objects references by batman-adv from
      being released after shutdown.
    ====================
Signed-off-by: David S. Miller davem@davemloft.net
commit 33656a1f2ee5346c742d63ddd0e0970c95a56b70
Merge: 5f40adb c26f6c6
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Mon May 2 09:59:57 2016 -0700
Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
Pull UDF fix from Jan Kara:
     "A fix of a regression in UDF that got introduced in 4.6-rc1 by one of
      the charset encoding fixes"
* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
      udf: Fix conversion of 'dstring' fields to UTF8
commit 5f40adbc3eebd7e1c55ec87315e762924a36fe76
Merge: 9c5d1bc 7df89e9
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Mon May 2 09:54:22 2016 -0700
Merge tag 'gpio-v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio
Pull GPIO fixes from Linus Walleij:
     "Here are some late but important fixes for the v4.6 kernel series.
      ACPI and RCAR, so two driver fixes (PM related) and a self-evident
      string lookup fix for ACPI GPIOs:
- A serious ACPI fix targeted for stable: lookup strings were being
         free'd.
- Revert two patches from the RCAR driver"
* tag 'gpio-v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
      gpiolib-acpi: Duplicate con_id string when adding it to the crs lookup list
      Revert "gpio: rcar: Fine-grained Runtime PM support"
      Revert "gpio: rcar: Add Runtime PM handling for interrupts"
commit 9c5d1bc2b73609ada2eaba75e9c8f4963e95b977
Merge: ba22906 b7f8fe2
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Mon May 2 09:40:42 2016 -0700
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Pull networking fixes from David Miller:
1) MODULE_FIRMWARE firmware string not correct for iwlwifi 8000 chips,
        from Sara Sharon.
2) Fix SKB size checks in batman-adv stack on receive, from Sven
        Eckelmann.
3) Leak fix on mac80211 interface add error paths, from Johannes Berg.
4) Cannot invoke napi_disable() with BH disabled in myri10ge driver,
        fix from Stanislaw Gruszka.
5) Fix sign extension problem when computing feature masks in
        net_gso_ok(), from Marcelo Ricardo Leitner.
6) lan78xx driver doesn't count packets and packet lengths in its
        statistics properly, fix from Woojung Huh.
7) Fix the buffer allocation sizes in pegasus USB driver, from Petko
        Manolov.
8) Fix refcount overflows in bpf, from Alexei Starovoitov.
9) Unified dst cache handling introduced a preempt warning in
        ip_tunnel, fix by resetting rather then setting the cached route.
        From Paolo Abeni.
10) Listener hash collision test fix in soreuseport, from Craig Gallak
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (47 commits)
      gre: do not pull header in ICMP error processing
      net: Implement net_dbg_ratelimited() for CONFIG_DYNAMIC_DEBUG case
      tipc: only process unicast on intended node
      cxgb3: fix out of bounds read
      net/smscx5xx: use the device tree for mac address
      soreuseport: Fix TCP listener hash collision
      net: l2tp: fix reversed udp6 checksum flags
      ip_tunnel: fix preempt warning in ip tunnel creation/updating
      samples/bpf: fix trace_output example
      bpf: fix check_map_func_compatibility logic
      bpf: fix refcnt overflow
      drivers: net: cpsw: use of_phy_connect() in fixed-link case
      dt: cpsw: phy-handle, phy_id, and fixed-link are mutually exclusive
      drivers: net: cpsw: don't ignore phy-mode if phy-handle is used
      drivers: net: cpsw: fix segfault in case of bad phy-handle
      drivers: net: cpsw: fix parsing of phy-handle DT property in dual_emac config
      MAINTAINERS: net: Change maintainer for GRETH 10/100/1G Ethernet MAC device driver
      gre: reject GUE and FOU in collect metadata mode
      pegasus: fixes reported packet length
      pegasus: fixes URB buffer allocation size;
      ...
commit ba22906a9fdb197b10e3e062dc8c438efb7ea6f6
Merge: 04974df 49fa523
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Mon May 2 09:32:50 2016 -0700
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc
Pull sparc fixes from David Miller:
1) Fix panics with SR-IOV, from Babu Moger.
2) Wire up preadv2/pwritev2.
3) Allow proper auto-loading of VIO devices, from John Paul Adrian
        Glaubitz.
4) Recognize Sonoma cpus, from Khalid Aziz.
5) Fix bootup regressions caused by syscall trace fixes made recently.
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
      sparc64: Fix bootup regressions on some Kconfig combinations.
      sparc64: recognize and support Sonoma CPU type
      sparc: Implement and wire up vio_hotplug for vio.
      sparc: Implement and wire up modalias_show for vio.
      sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata
      sparc/defconfigs: Remove CONFIG_IPV6_PRIVACY
      sparc: Write up preadv2/pwritev2 syscalls.
      sparc/PCI: Fix for panic while enabling SR-IOV
commit b7f8fe251e4609e2a437bd2c2dea01e61db6849c
Author: Jiri Benc jbenc@redhat.com
Date:   Fri Apr 29 23:31:32 2016 +0200
gre: do not pull header in ICMP error processing
iptunnel_pull_header expects that IP header was already pulled; with this
    expectation, it pulls the tunnel header. This is not true in gre_err.
    Furthermore, ipv4_update_pmtu and ipv4_redirect expect that skb->data points
    to the IP header.
We cannot pull the tunnel header in this path. It's just a matter of not
    calling iptunnel_pull_header - we don't need any of its effects.
Fixes: bda7bb463436 ("gre: Allow multiple protocol listener for gre protocol.")
    Signed-off-by: Jiri Benc jbenc@redhat.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit 2c94b53738549d81dc7464a32117d1f5112c64d3
Author: Tim Bingham tbingham@akamai.com
Date:   Fri Apr 29 13:30:23 2016 -0400
net: Implement net_dbg_ratelimited() for CONFIG_DYNAMIC_DEBUG case
Prior to commit d92cff89a0c8 ("net_dbg_ratelimited: turn into no-op
    when !DEBUG") the implementation of net_dbg_ratelimited() was buggy
    for both the DEBUG and CONFIG_DYNAMIC_DEBUG cases.
The bug was that net_ratelimit() was being called and, despite
    returning true, nothing was being printed to the console. This
    resulted in messages like the following -
"net_ratelimit: %d callbacks suppressed"
with no other output nearby.
After commit d92cff89a0c8 ("net_dbg_ratelimited: turn into no-op when
    !DEBUG") the bug is fixed for the DEBUG case. However, there's no
    output at all for CONFIG_DYNAMIC_DEBUG case.
This patch restores debug output (if enabled) for the
    CONFIG_DYNAMIC_DEBUG case.
Add a definition of net_dbg_ratelimited() for the CONFIG_DYNAMIC_DEBUG
    case. The implementation takes care to check that dynamic debugging is
    enabled before calling net_ratelimit().
Fixes: d92cff89a0c8 ("net_dbg_ratelimited: turn into no-op when !DEBUG")
    Signed-off-by: Tim Bingham tbingham@akamai.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit efe790502be85c60daa65c8aa51f05c333186e12
Author: Hamish Martin hamish.martin@alliedtelesis.co.nz
Date:   Fri Apr 29 10:40:24 2016 -0400
tipc: only process unicast on intended node
We have observed complete lock up of broadcast-link transmission due to
    unacknowledged packets never being removed from the 'transmq' queue. This
    is traced to nodes having their ack field set beyond the sequence number
    of packets that have actually been transmitted to them.
    Consider an example where node 1 has sent 10 packets to node 2 on a
    link and node 3 has sent 20 packets to node 2 on another link. We
    see examples of an ack from node 2 destined for node 3 being treated as
    an ack from node 2 at node 1. This leads to the ack on the node 1 to node
    2 link being increased to 20 even though we have only sent 10 packets.
    When node 1 does get around to sending further packets, none of the
    packets with sequence numbers less than 21 are actually removed from the
    transmq.
    To resolve this we reinstate some code lost in commit d999297c3dbb ("tipc:
    reduce locking scope during packet reception") which ensures that only
    messages destined for the receiving node are processed by that node. This
    prevents the sequence numbers from getting out of sync and resolves the
    packet leakage, thereby resolving the broadcast-link transmission
    lock-ups we observed.
While we are aware that this change only patches over a root problem that
    we still haven't identified, this is a sanity test that it is always
    legitimate to do. It will remain in the code even after we identify and
    fix the real problem.
Reviewed-by: Chris Packham chris.packham@alliedtelesis.co.nz
    Reviewed-by: John Thompson john.thompson@alliedtelesis.co.nz
    Signed-off-by: Hamish Martin hamish.martin@alliedtelesis.co.nz
    Signed-off-by: Jon Maloy jon.maloy@ericsson.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit 0b86a2a1e5807326f8eb44e9919d0baadeda3a69
Author: Michal Schmidt mschmidt@redhat.com
Date:   Fri Apr 29 11:06:50 2016 +0200
cxgb3: fix out of bounds read
An out of bounds read of 2 bytes was discovered in cxgb3 with KASAN.
t3_config_rss() expects both arrays it gets as parameters to have
    terminators. setup_rss(), the caller, forgets to add a terminator to
    one of the arrays. Thankfully the iteration in t3_config_rss() stops
    anyway, but in the last iteration the check for the terminator
    is an out of bounds read.
Add the missing terminator to rspq_map[].
Reported-by: Jan Stancek jstancek@redhat.com
    Signed-off-by: Michal Schmidt mschmidt@redhat.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit c489565b536ff5382460273fd9513f0adebec024
Author: Arnd Bergmann arnd@arndb.de
Date:   Fri Apr 29 09:05:59 2016 +0200
net/smscx5xx: use the device tree for mac address
This takes the MAC address for smsc75xx/smsc95xx USB network devices
    from a the device tree. This is required to get a usable persistent
    address on the popular beagleboard, whose hardware designers
    accidentally forgot that an ethernet device really requires an a
    MAC address to be functional.
The Raspberry Pi also ships smsc9514 without a serial EEPROM, stores
    the MAC address in ROM accessible via VC4 firmware.
The smsc75xx and smsc95xx drivers are just two copies of the
    same code, so better fix both.
[lkundrak@v3.sk: updated to use of_get_property() as per suggestion from
    Arnd, reworded the message and comments a bit]
Tested-by: Lubomir Rintel lkundrak@v3.sk
    Signed-off-by: Arnd Bergmann arnd@arndb.de
    Signed-off-by: Lubomir Rintel lkundrak@v3.sk
    Signed-off-by: David S. Miller davem@davemloft.net
commit 90e5d0db2b221f0cbbb91e9e61fdb7dbb9e1afc2
Author: Craig Gallek kraig@google.com
Date:   Thu Apr 28 19:24:32 2016 -0400
soreuseport: Fix TCP listener hash collision
I forgot to include a check for listener port equality when deciding
    if two sockets should belong to the same reuseport group.  This was
    not caught previously because it's only necessary when two listening
    sockets for the same user happen to hash to the same listener bucket.
    The same error does not exist in the UDP path.
Fixes: c125e80b8868("soreuseport: fast reuseport TCP socket selection")
    Signed-off-by: Craig Gallek kraig@google.com
    Acked-by: Eric Dumazet edumazet@google.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit 018f8258582381bcce484312f0e9ec2970d0383e
Author: Wang Shanker shankerwangmiao@gmail.com
Date:   Fri Apr 29 01:29:43 2016 +0800
net: l2tp: fix reversed udp6 checksum flags
This patch fixes a bug which causes the behavior of whether to ignore
    udp6 checksum of udp6 encapsulated l2tp tunnel contrary to what
    userspace program requests.
When the flag `L2TP_ATTR_UDP_ZERO_CSUM6_RX` is set by userspace, it is
    expected that udp6 checksums of received packets of the l2tp tunnel
    to create should be ignored. In `l2tp_netlink.c`:
    `l2tp_nl_cmd_tunnel_create()`, `cfg.udp6_zero_rx_checksums` is set
    according to the flag, and then passed to `l2tp_core.c`:
    `l2tp_tunnel_create()` and then `l2tp_tunnel_sock_create()`. In
    `l2tp_tunnel_sock_create()`, `udp_conf.use_udp6_rx_checksums` is set
    the same to `cfg.udp6_zero_rx_checksums`. However, if we want the
    checksum to be ignored, `udp_conf.use_udp6_rx_checksums` should be set
    to `false`, i.e. be set to the contrary. Similarly, the same should be
    done to `udp_conf.use_udp6_tx_checksums`.
Signed-off-by: Miao Wang shankerwangmiao@gmail.com
    Acked-by: James Chapman jchapman@katalix.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit 04974df8049fc4240d22759a91e035082ccd18b4
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Sun May 1 15:52:31 2016 -0700
Linux 4.6-rc6
commit da9373d67c8a7adf7d820f24fe672c5540f231ac
Merge: 1b46bac 15333e3
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Sat Apr 30 18:57:42 2016 -0700
Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal
Pull thermal fixes from Eduardo Valentin:
     "A couple of minor fixes for the thermal subsystem.
Specifics in this pull request:
- Fixes in hisilicon thermal driver
       - More fixes of unsigned to int type change in thermal_core.c"
* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal:
      thermal: use %d to print S32 parameters
      thermal: hisilicon: increase temperature resolution
commit 7df89e92a56a3d2c8f84aa76c61471e4a7bc24f9
Author: Ville Syrjälä ville.syrjala@linux.intel.com
Date:   Mon Apr 25 16:01:19 2016 +0300
gpiolib-acpi: Duplicate con_id string when adding it to the crs lookup list
Calling gpiod_get() from a module and then unloading the module leads to an
    oops due to acpi_can_fallback_to_crs() storing the pointer to the passed
    'con_id' string onto acpi_crs_lookup_list. The next guy to come along will then
    try to access the string but the memory may now be gone with the module.
    Make a copy of the passed string instead, and store the copy on the list.
BUG: unable to handle kernel paging request at ffffffffa03e7855
    IP: [<ffffffff81338322>] strcmp+0x12/0x30
    PGD 2a07067 PUD 2a08063 PMD 74720067 PTE 0
    Oops: 0000 [#1] PREEMPT SMP
    Modules linked in: i915(+) drm_kms_helper drm intel_gtt snd_hda_codec snd_hda_core i2c_algo_bit syscopya
    rea sysfillrect sysimgblt fb_sys_fops agpgart snd_soc_sst_bytcr_rt5640 coretemp hwmon intel_rapl intel_soc_dts_thermal
    punit_atom_debug snd_soc_rt5640 snd_soc_rl6231 serio snd_intel_sst_acpi snd_intel_sst_core video snd_soc_sst_mfld_platf
    orm snd_soc_sst_match backlight int3402_thermal processor_thermal_device int3403_thermal int3400_thermal acpi_thermal_r
    el snd_soc_core intel_soc_dts_iosf int340x_thermal_zone snd_compress i2c_hid hid snd_pcm snd_timer snd soundcore evdev
    sch_fq_codel efivarfs ipv6 autofs4 [last unloaded: drm]
    CPU: 2 PID: 3064 Comm: modprobe Tainted: G     U  W       4.6.0-rc3-ffrd-ipvr+ #302
    Hardware name: Intel Corp. VALLEYVIEW C0 PLATFORM/BYT-T FFD8, BIOS BLAKFF81.X64.0088.R10.1403240443 FFD8
    _X64_R_2014_13_1_00 03/24/2014
    task: ffff8800701cd200 ti: ffff880070034000 task.ti: ffff880070034000
    RIP: 0010:[<ffffffff81338322>]  [<ffffffff81338322>] strcmp+0x12/0x30
    RSP: 0000:ffff880070037748  EFLAGS: 00010286
    RAX: 0000000080000000 RBX: ffff88007a342800 RCX: 0000000000000006
    RDX: 0000000000000006 RSI: ffffffffa054f856 RDI: ffffffffa03e7856
    RBP: ffff880070037748 R08: 0000000000000000 R09: 0000000000000001
    R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffa054f855
    R13: ffff88007281cae0 R14: 0000000000000010 R15: ffffffffffffffea
    FS:  00007faa51447700(0000) GS:ffff880079300000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: ffffffffa03e7855 CR3: 0000000041eba000 CR4: 00000000001006e0
    Stack:
     ffff880070037770 ffffffff8136ad28 ffffffffa054f855 0000000000000000
     ffff88007a0a2098 ffff8800700377e8 ffffffff8136852e ffff88007a342800
     00000007700377a0 ffff8800700377a0 ffffffff81412442 70672d6c656e6170
    Call Trace:
     [<ffffffff8136ad28>] acpi_can_fallback_to_crs+0x88/0x100
     [<ffffffff8136852e>] gpiod_get_index+0x25e/0x310
     [<ffffffff81412442>] ? mipi_dsi_attach+0x22/0x30
     [<ffffffff813685f2>] gpiod_get+0x12/0x20
     [<ffffffffa04fcf41>] intel_dsi_init+0x421/0x480 [i915]
     [<ffffffffa04d3783>] intel_modeset_init+0x853/0x16b0 [i915]
     [<ffffffffa0504864>] ? intel_setup_gmbus+0x214/0x260 [i915]
     [<ffffffffa0510158>] i915_driver_load+0xdc8/0x19b0 [i915]
     [<ffffffff8160fb53>] ? _raw_spin_unlock_irqrestore+0x43/0x70
     [<ffffffffa026b13b>] drm_dev_register+0xab/0xc0 [drm]
     [<ffffffffa026d7b3>] drm_get_pci_dev+0x93/0x1f0 [drm]
     [<ffffffff8160fb53>] ? _raw_spin_unlock_irqrestore+0x43/0x70
     [<ffffffffa043f1f4>] i915_pci_probe+0x34/0x50 [i915]
     [<ffffffff81379751>] pci_device_probe+0x91/0x100
     [<ffffffff8141a75a>] driver_probe_device+0x20a/0x2d0
     [<ffffffff8141a8be>] __driver_attach+0x9e/0xb0
     [<ffffffff8141a820>] ? driver_probe_device+0x2d0/0x2d0
     [<ffffffff81418439>] bus_for_each_dev+0x69/0xa0
     [<ffffffff8141a04e>] driver_attach+0x1e/0x20
     [<ffffffff81419c20>] bus_add_driver+0x1c0/0x240
     [<ffffffff8141b6d0>] driver_register+0x60/0xe0
     [<ffffffff81377d20>] __pci_register_driver+0x60/0x70
     [<ffffffffa026d9f4>] drm_pci_init+0xe4/0x110 [drm]
     [<ffffffff810ce04e>] ? trace_hardirqs_on+0xe/0x10
     [<ffffffffa02f1000>] ? 0xffffffffa02f1000
     [<ffffffffa02f1094>] i915_init+0x94/0x9b [i915]
     [<ffffffff810003bb>] do_one_initcall+0x8b/0x1c0
     [<ffffffff810eb616>] ? rcu_read_lock_sched_held+0x86/0x90
     [<ffffffff811de6d6>] ? kmem_cache_alloc_trace+0x1f6/0x270
     [<ffffffff81183826>] do_init_module+0x60/0x1dc
     [<ffffffff81115a8d>] load_module+0x1d0d/0x2390
     [<ffffffff811120b0>] ? __symbol_put+0x70/0x70
     [<ffffffff811f41b2>] ? kernel_read_file+0x92/0x120
     [<ffffffff811162f4>] SYSC_finit_module+0xa4/0xb0
     [<ffffffff8111631e>] SyS_finit_module+0xe/0x10
     [<ffffffff81001ff3>] do_syscall_64+0x63/0x350
     [<ffffffff816103da>] entry_SYSCALL64_slow_path+0x25/0x25
    Code: f7 48 8d 76 01 48 8d 52 01 0f b6 4e ff 84 c9 88 4a ff 75 ed 5d c3 0f 1f 00 55 48 89 e5 eb 04 84 c0
     74 18 48 8d 7f 01 48 8d 76 01 <0f> b6 47 ff 3a 46 ff 74 eb 19 c0 83 c8 01 5d c3 31 c0 5d c3 66
    RIP  [<ffffffff81338322>] strcmp+0x12/0x30
     RSP <ffff880070037748>
    CR2: ffffffffa03e7855
v2: Make the copied con_id const
Cc: Dmitry Torokhov dmitry.torokhov@gmail.com
    Cc: Mika Westerberg mika.westerberg@linux.intel.com
    Cc: Alexandre Courbot gnurou@gmail.com
    Cc: stable@vger.kernel.org
    Fixes: 10cf4899f8af ("gpiolib: tighten up ACPI legacy gpio lookups")
    Signed-off-by: Ville Syrjälä ville.syrjala@linux.intel.com
    Acked-by: Mika Westerberg mika.westerberg@linux.intel.com
    Reviewed-by: Dmitry Torokhov dmitry.torokhov@gmail.com
    Signed-off-by: Linus Walleij linus.walleij@linaro.org
commit 1b46bac6275506db73592aa8b9bd1d67c79b95dc
Merge: 65c4cbe d701cca
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Fri Apr 29 18:50:08 2016 -0700
Merge tag 'powerpc-4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux
Pull powerpc fixes from Michael Ellerman:
     "A few more powerpc fixes for 4.6:
- cxl: Keep IRQ mappings on context teardown from Michael Neuling
- cxl: Poll for outstanding IRQs when detaching a context from
         Michael Neuling
- Wire up preadv2 and pwritev2 syscalls from Rui Salvaterra"
* tag 'powerpc-4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
      powerpc: wire up preadv2 and pwritev2 syscalls
      cxl: Poll for outstanding IRQs when detaching a context
      cxl: Keep IRQ mappings on context teardown
commit 65c4cbeba797e3fce68aba899e066f50e638e08d
Merge: b49a519 c4fc195
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Fri Apr 29 17:59:26 2016 -0700
Merge tag 'edac_fix_for_4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp
Pull EDAC fix from Borislav Petkov:
     "Make sure sb_edac and i7core_edac do not terminate MCE processing on
      the decoding callchain prematurely"
* tag 'edac_fix_for_4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
      EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
commit b49a5195e2e737d06144e024ae092ad915722250
Merge: a8feb78 81be193
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Fri Apr 29 17:39:51 2016 -0700
Merge tag 'pm+acpi-4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
     "One revert of a recent cpufreq commit that introduced a regression and
      a fix for intel_pstate's Turbo Activation Ratio handling code.
Specifics:
- Revert cpufreq commit that attempted to fix a problem in the
         ondemand/conservative governor code, but did that incorrectly and
         introduced another problem instead (Rafael Wysocki).
- Fix incorrect decoding of MSR contents related to the Turbo
         Activation Ratio (TAR) handling in the intel_pstate driver
         (Srinivas Pandruvada)"
* tag 'pm+acpi-4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
      cpufreq: intel_pstate: Fix processing for turbo activation ratio
      Revert "cpufreq: governor: Fix negative idle_time when configured with CONFIG_HZ_PERIODIC"
commit a8feb782092f01370c7999c3c0823f6120f29241
Merge: b9cc335 2963070
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Fri Apr 29 17:32:19 2016 -0700
Merge tag 'mmc-v4.6-rc4' of git://git.linaro.org/people/ulf.hansson/mmc
Pull MMC fixes from Ulf Hansson:
     "Here are a two MMC host fixes:
- sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs
- sunxi: Disable eMMC HS-DDR for Allwinner A80"
* tag 'mmc-v4.6-rc4' of git://git.linaro.org/people/ulf.hansson/mmc:
      mmc: sunxi: Disable eMMC HS-DDR (MMC_CAP_1_8V_DDR) for Allwinner A80
      mmc: sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs
commit b9cc335ffae82255404507fcd0680a77cc215c5b
Merge: 925d96a ea99697
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Fri Apr 29 17:18:55 2016 -0700
Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux
Pull drm fixes from Dave Airlie:
     "A few fixes all over the place:
radeon is probably the biggest standout, it's a fix for screen
      corruption or hung black outputs so I thought it was worth pulling in.
Otherwise some amdgpu power control fixes, some misc vmwgfx fixes, one
      etnaviv fix, one virtio-gpu fix, two DP MST fixes, and a single TTM
      fix"
* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
      drm/vmwgfx: Fix order of operation
      drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands.
      drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION
      drm/amdgpu: disable vm interrupts with vm_fault_stop=2
      drm/amdgpu: print a message if ATPX dGPU power control is missing
      Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
      drm/radeon: fix vertical bars appear on monitor (v2)
      drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
      drm/virtio: send vblank event after crtc updates
      drm/dp/mst: Restore primary hub guid on resume
      drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
      drm/etnaviv: don't move linear memory window on 3D cores without MC2.0
commit 925d96a0c9af72e419dbca1db325e09d78f31502
Merge: 1d003af 4c8bb95
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Fri Apr 29 17:07:54 2016 -0700
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma
Pull rdma fixes from Doug Ledford:
     "Final set of -rc fixes for 4.6.
I've collected up a number of patches that are all pretty small with
      the exception of only a couple.  The hfi1 driver has a number of
      important patches, and it is what really drives the line count of this
      pull request up.  These are all small and I've got this kernel built
      and running in the test lab (I have most of the hardware, I think nes
      is the only thing in this patch set that I can't say I've personally
      tested and have up and running).
Summary:
- A number of collected fixes for oopses, memory corruptions,
         deadlocks, etc.  All of these fixes are small (many only 5-10
         lines), obvious, and tested.
- Fix for the security issue related to the use of write for
         bi-directional communications"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
      RDMA/nes: don't leak skb if carrier down
      IB/security: Restrict use of the write() interface
      IB/hfi1: Use kernel default llseek for ui device
      IB/hfi1: Don't attempt to free resources if initialization failed
      IB/hfi1: Fix missing lock/unlock in verbs drain callback
      IB/rdmavt: Fix send scheduling
      IB/hfi1: Prevent unpinning of wrong pages
      IB/hfi1: Fix deadlock caused by locking with wrong scope
      IB/hfi1: Prevent NULL pointer deferences in caching code
      MAINTAINERS: Update iser/isert maintainer contact info
      IB/mlx5: Expose correct max_sge_rd limit
      RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips
      iw_cxgb4: handle draining an idle qp
      iw_cxgb3: initialize ibdev.iwcm->ifname for port mapping
      iw_cxgb4: initialize ibdev.iwcm->ifname for port mapping
      IB/core: Don't drain non-existent rq queue-pair
      IB/core: Fix oops in ib_cache_gid_set_default_gid
commit 1d003af2effbf10ef7b08736606dd306a29b3396
Merge: 92c19ea 7c88a29
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Fri Apr 29 11:21:22 2016 -0700
Merge branch 'akpm' (patches from Andrew)
Merge fixes from Andrew Morton:
     "20 fixes"
* emailed patches from Andrew Morton akpm@linux-foundation.org:
      Documentation/sysctl/vm.txt: update numa_zonelist_order description
      lib/stackdepot.c: allow the stack trace hash to be zero
      rapidio: fix potential NULL pointer dereference
      mm/memory-failure: fix race with compound page split/merge
      ocfs2/dlm: return zero if deref_done message is successfully handled
      Ananth has moved
      kcov: don't profile branches in kcov
      kcov: don't trace the code coverage code
      mm: wake kcompactd before kswapd's short sleep
      .mailmap: add Frank Rowand
      mm/hwpoison: fix wrong num_poisoned_pages accounting
      mm: call swap_slot_free_notify() with page lock held
      mm: vmscan: reclaim highmem zone if buffer_heads is over limit
      numa: fix /proc/<pid>/numa_maps for THP
      mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check
      mailmap: fix Krzysztof Kozlowski's misspelled name
      thp: keep huge zero page pinned until tlb flush
      mm: exclude HugeTLB pages from THP page_mapped() logic
      kexec: export OFFSET(page.compound_head) to find out compound tail page
      kexec: update VMCOREINFO for compound_order/dtor
commit f27337e16f2d0e52a8d05ea599ed13cd266ac291
Author: Paolo Abeni pabeni@redhat.com
Date:   Thu Apr 28 11:04:51 2016 +0200
ip_tunnel: fix preempt warning in ip tunnel creation/updating
After the commit e09acddf873b ("ip_tunnel: replace dst_cache with generic
    implementation"), a preemption debug warning is triggered on ip4
    tunnels updating; the dst cache helper needs to be invoked in unpreemptible
    context.
We don't need to load the cache on tunnel update, so this commit fixes
    the warning replacing the load with a dst cache reset, which is
    preempt safe.
Fixes: e09acddf873b ("ip_tunnel: replace dst_cache with generic implementation")
    Reported-by: Eric Dumazet eric.dumazet@gmail.com
    Signed-off-by: Paolo Abeni pabeni@redhat.com
    Acked-by: Eric Dumazet edumazet@google.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit c4fc1956fa31003bfbe4f597e359d751568e2954
Author: Tony Luck tony.luck@intel.com
Date:   Fri Apr 29 15:42:25 2016 +0200
EDAC: i7core, sb_edac: Don't return NOTIFY_BAD from mce_decoder callback
Both of these drivers can return NOTIFY_BAD, but this terminates
    processing other callbacks that were registered later on the chain.
    Since the driver did nothing to log the error it seems wrong to prevent
    other interested parties from seeing it. E.g. neither of them had even
    bothered to check the type of the error to see if it was a memory error
    before the return NOTIFY_BAD.
Signed-off-by: Tony Luck tony.luck@intel.com
    Acked-by: Aristeu Rozanski aris@redhat.com
    Acked-by: Mauro Carvalho Chehab mchehab@osg.samsung.com
    Cc: linux-edac linux-edac@vger.kernel.org
    Cc: stable@vger.kernel.org
    Link: http://lkml.kernel.org/r/72937355dd92318d2630979666063f8a2853495b.1461864507...
    Signed-off-by: Borislav Petkov bp@suse.de
commit 81be193b7e2089dc34a4e3939f1b057f53995f56
Merge: 02da2d7 1becf03
Author: Rafael J. Wysocki rafael.j.wysocki@intel.com
Date:   Fri Apr 29 14:22:25 2016 +0200
Merge branch 'pm-cpufreq-fixes'
* pm-cpufreq-fixes:
      cpufreq: intel_pstate: Fix processing for turbo activation ratio
      Revert "cpufreq: governor: Fix negative idle_time when configured with CONFIG_HZ_PERIODIC"
commit ea99697814d6e64927e228675a6eb7fa76014648
Merge: d8ba5d6 afc4542
Author: Dave Airlie airlied@redhat.com
Date:   Fri Apr 29 14:31:44 2016 +1000
Merge branch 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
A few fixes for 4.6.
    - revert amdgpu PX commit that was previously reverted on the radeon side
    - cleaned up version of the NI+ MC update display fix for radeon
    - TTM kref fix
* 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux:
      drm/amdgpu: disable vm interrupts with vm_fault_stop=2
      drm/amdgpu: print a message if ATPX dGPU power control is missing
      Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
      drm/radeon: fix vertical bars appear on monitor (v2)
      drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
commit d8ba5d60d59fd1db5b53c8a110c2f8321591a9d8
Merge: 9a11d2e 7851496
Author: Dave Airlie airlied@redhat.com
Date:   Fri Apr 29 14:27:50 2016 +1000
Merge branch 'drm-vmwgfx-fixes' of git://people.freedesktop.org/~syeh/repos_linux into drm-fixes
three misc vmwgfx fixes
* 'drm-vmwgfx-fixes' of git://people.freedesktop.org/~syeh/repos_linux:
      drm/vmwgfx: Fix order of operation
      drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands.
      drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION
commit 92c19ea9535707701861b7533253a516c7d115c9
Merge: 814dd94 1bdb897
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Thu Apr 28 20:24:27 2016 -0700
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
     "Two boot crash fixes and an IRQ handling crash fix"
* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      x86/apic: Handle zero vector gracefully in clear_vector_irq()
      Revert "x86/mm/32: Set NX in __supported_pte_mask before enabling paging"
      xen/qspinlock: Don't kick CPU if IRQ is not initialized
commit 814dd9481d2045cc99a10a45d267a6167c5cd8ff
Merge: 2113caed cf3beb7
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Thu Apr 28 20:19:04 2016 -0700
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf fixes from Ingo Molnar:
     "x86 PMU driver fixes plus a core code race fix"
* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      perf/x86/intel: Fix incorrect lbr_sel_mask value
      perf/x86/intel/pt: Don't die on VMXON
      perf/core: Fix perf_event_open() vs. execve() race
      perf/x86/amd: Set the size of event map array to PERF_COUNT_HW_MAX
      perf/core: Make sysctl_perf_cpu_time_max_percent conform to documentation
      perf/x86/intel/rapl: Add missing Haswell model
      perf/x86/intel: Add model number for Skylake Server to perf
commit 2113caed87dd372e5ca2d9b3cba415f4da38936b
Merge: 8f3603a 75dd602
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Thu Apr 28 19:59:17 2016 -0700
Merge branch 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
     "Two lockdep fixes"
* 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      lockdep: Fix lock_chain::base size
      locking/lockdep: Fix ->irq_context calculation
commit 8f3603a210970d665e7cecf6623331ce6b24f713
Merge: ba14e96 ede85e9
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Thu Apr 28 19:54:50 2016 -0700
Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull EFI fix from Ingo Molnar:
     "This fixes a bug in the efivars code"
* 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      efi: Fix out-of-bounds read in variable_matches()
commit ba14e961b4fc0b0efcb1b2af7aab605bfce55fb8
Merge: e1f14a5 89a09566
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Thu Apr 28 19:44:47 2016 -0700
Merge tag 'media/v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media fixes from Mauro Carvalho Chehab:
     "Some regression fixes:
- videobuf2 core: avoid the risk of going past buffer on multi-planes
         and fix rw mode
- fix support for 4K formats at V4L2 core
- fix a trouble at davinci_fpe, caused by a bad patch
- usbvision: revert a patch with a partial fixup.  The fixup patch
         was merged already, and this one has some issues"
* tag 'media/v4.6-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
      [media] vb2-memops: Fix over allocation of frame vectors
      [media] media: vb2: Fix regression on poll() for RW mode
      [media] v4l2-dv-timings.h: fix polarity for 4k formats
      [media] davinci_vpfe: Revert "staging: media: davinci_vpfe: remove,unnecessary ret variable"
      [media] usbvision: revert commit 588afcc1
      [media] videobuf2-v4l2: Verify planes array in buffer dequeueing
      [media] videobuf2-core: Check user space planes array in dqbuf
commit e1f14a54694faa5cdc91d4933cd3412809ef5d67
Merge: 6fa9bff af9cc93
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Thu Apr 28 19:38:45 2016 -0700
Merge tag 'sound-4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
     "Usually we get a big collection of fixes for ASoC once during rc.  And
      this is it.
At this time, most of fixes are about Intel Skylake ASoC driver, which
      is a new and still on-going development.  Along with it, a slight
      large LOC is seen in legacy HD-audio driver, but it's merely a code
      move to the upper layer.
Other than that, the rest are small or trivial fixes to various
      drivers, in addition to an ASoC dapm debugfs code fix"
* tag 'sound-4.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (24 commits)
      ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW
      ALSA: hda - Add dock support for ThinkPad X260
      ASoC: wm5102: Free compressed IRQ in CODEC remove
      ASoC: arizona: Free speaker thermal IRQs in CODEC remove
      ASoC: Intel: Skylake: Fix ibs/obs calc for non-integral sampling rates
      ASoC: Intel: sst: fix a loop timeout in sst_hsw_stream_reset()
      ASoC: Intel: Skylake: Fix to turn OFF codec power when entering S3
      ASoC: hdac_hdmi: Fix codec power state in S3 during playback
      ASoC: hdac_hdmi: Fix to use dev_pm ops instead soc pm
      ASoC: wm8962: Correct typo when setting DSPCLK rate
      ASoC: nau8825: Fix jack detection across suspend
      ASoC: Intel: Skylake: Fix DSP resource de-allocation
      ASoC: Intel: Skylake: Fix for unloading module only when it is loaded
      ASoC: Intel: Skylake: Fix kbuild dependency
      ASoC: dapm: Make sure we have a card when displaying component widgets
      ASoC: rt5640: Correct the digital interface data select
      ASoC: Intel: Skylake: remove call to pci_dev_put
      ASoC: Intel: Skylake: Call i915 exit last
      ASoC: Intel: Skylake: Unmap the address last
      ASoC: Intel: Skylake: Freeup properly on skl_dsp_free
      ...
commit 7c88a292dfcd6979e839493ef18d04770eb3bad0
Author: Xishi Qiu qiuxishi@huawei.com
Date:   Thu Apr 28 16:19:11 2016 -0700
Documentation/sysctl/vm.txt: update numa_zonelist_order description
Commit 3193913ce62c ("mm: page_alloc: default node-ordering on 64-bit
    NUMA, zone-ordering on 32-bit") changes the default value of
    numa_zonelist_order.  Update the document.
Signed-off-by: Xishi Qiu qiuxishi@huawei.com
    Cc: Mel Gorman mgorman@suse.de
    Cc: Johannes Weiner hannes@cmpxchg.org
    Cc: Rik van Riel riel@redhat.com
    Cc: David Rientjes rientjes@google.com
    Cc: Kamezawa Hiroyuki kamezawa.hiroyu@jp.fujitsu.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 33334e25769c6ad69b983379578f42581d99a2f9
Author: Alexander Potapenko glider@google.com
Date:   Thu Apr 28 16:19:09 2016 -0700
lib/stackdepot.c: allow the stack trace hash to be zero
Do not bail out from depot_save_stack() if the stack trace has zero hash.
    Initially depot_save_stack() silently dropped stack traces with zero
    hashes, however there's actually no point in reserving this zero value.
Reported-by: Joonsoo Kim iamjoonsoo.kim@lge.com
    Signed-off-by: Alexander Potapenko glider@google.com
    Acked-by: Andrey Ryabinin aryabinin@virtuozzo.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 99f23c2cded85a377325aa9fd374ffa3d55d1088
Author: Vladimir Zapolskiy vz@mleia.com
Date:   Thu Apr 28 16:19:06 2016 -0700
rapidio: fix potential NULL pointer dereference
The change fixes improper check for a returned error value by
    class_create() function, which on error returns ERR_PTR() value, thus the
    original check always results in a dead code on error path.
Signed-off-by: Vladimir Zapolskiy vz@mleia.com
    Signed-off-by: Alexandre Bounine alexandre.bounine@idt.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit c2e7e00b715d3c65f301bec8559d6af4ef8098ab
Author: Konstantin Khlebnikov khlebnikov@yandex-team.ru
Date:   Thu Apr 28 16:19:03 2016 -0700
mm/memory-failure: fix race with compound page split/merge
get_hwpoison_page() must recheck relation between head and tail pages.
n-horiguchi said: without this recheck, the race causes kernel to pin an
    irrelevant page, and finally makes kernel crash for refcount mismatch.
Signed-off-by: Konstantin Khlebnikov khlebnikov@yandex-team.ru
    Acked-by: Naoya Horiguchi n-horiguchi@ah.jp.nec.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit b73413647ee36406561618f68d0661d49dc47489
Author: xuejiufei xuejiufei@huawei.com
Date:   Thu Apr 28 16:19:01 2016 -0700
ocfs2/dlm: return zero if deref_done message is successfully handled
dlm_deref_lockres_done_handler() should return zero if the message is
    successfully handled.
Fixes: 60d663cb5273 ("ocfs2/dlm: add DEREF_DONE message").
    Signed-off-by: xuejiufei xuejiufei@huawei.com
    Reviewed-by: Joseph Qi joseph.qi@huawei.com
    Cc: Mark Fasheh mfasheh@suse.de
    Cc: Joel Becker jlbec@evilplan.org
    Cc: Junxiao Bi junxiao.bi@oracle.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit a320817c68e3fa1fc3ddaa709a1ad45cf533693b
Author: Ananth N Mavinakayanahalli ananth@in.ibm.com
Date:   Thu Apr 28 16:18:58 2016 -0700
Ananth has moved
The current ID is going away soon... update email address
Signed-off-by: Ananth N Mavinakayanahalli ananth@linux.vnet.ibm.com
    Cc: Masami Hiramatsu mhiramat@kernel.org
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 36f05ae8bce904b4c8105363e6227a79d343bda6
Author: Andrey Ryabinin aryabinin@virtuozzo.com
Date:   Thu Apr 28 16:18:55 2016 -0700
kcov: don't profile branches in kcov
Profiling 'if' statements in __sanitizer_cov_trace_pc() leads to
    unbound recursion and crash:
__sanitizer_cov_trace_pc() ->
    		ftrace_likely_update ->
    			__sanitizer_cov_trace_pc() ...
Define DISABLE_BRANCH_PROFILING to disable this tracer.
Signed-off-by: Andrey Ryabinin aryabinin@virtuozzo.com
    Cc: Dmitry Vyukov dvyukov@google.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit bdab42dfc974d15303afbf259f340f374a453974
Author: James Morse james.morse@arm.com
Date:   Thu Apr 28 16:18:52 2016 -0700
kcov: don't trace the code coverage code
Kcov causes the compiler to add a call to __sanitizer_cov_trace_pc() in
    every basic block.  Ftrace patches in a call to _mcount() to each
    function it has annotated.
Letting these mechanisms annotate each other is a bad thing.  Break the
    loop by adding 'notrace' to __sanitizer_cov_trace_pc() so that ftrace
    won't try to patch this code.
This patch lets arm64 with KCOV and STACK_TRACER boot.
Signed-off-by: James Morse james.morse@arm.com
    Acked-by: Dmitry Vyukov dvyukov@google.com
    Cc: Alexander Potapenko glider@google.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit fd901c95388b3bd5a6f749ed1d677a672b992298
Author: Vlastimil Babka vbabka@suse.cz
Date:   Thu Apr 28 16:18:49 2016 -0700
mm: wake kcompactd before kswapd's short sleep
When kswapd goes to sleep it checks if the node is balanced and at first
    it sleeps only for HZ/10 time, then rechecks if the node is still
    balanced and nobody has woken it during the initial sleep.  Only then it
    goes fully sleep until an allocation slowpath wakes it up again.
For higher-order allocations, waking up kcompactd is done only before
    the full sleep.  This turns out to be an issue in case another
    high-order allocation fails during the initial sleep.  It will wake
    kswapd up, however kswapd considers the zone balanced from the order-0
    perspective, and will just quickly try to sleep again.  So if there's a
    longer stream of high-order allocations hitting the slowpath and waking
    up kswapd, it might never actually wake up kcompactd, which may be
    considered a regression from kswapd-based compaction.  In the worst
    case, it might be that a single allocation that cannot direct
    reclaim/compact itself is waking kswapd in the retry loop and preventing
    kcompactd from being woken up and unblocking it.
This patch makes sure kcompactd is woken up in such situations by simply
    moving the wakeup before the short initial sleep.  More efficient
    solution would be to wake kcompactd immediately instead of kswapd if the
    node is already order-0 balanced, but in that case we should also move
    reset_isolation_suitable() call to kcompactd so it's not adding to the
    allocator's latency.  Since it's late in the 4.6 cycle, let's go with
    the simpler change for now.
Fixes: accf62422b3a ("mm, kswapd: replace kswapd compaction with waking up kcompactd")
    Signed-off-by: Vlastimil Babka vbabka@suse.cz
    Cc: Andrea Arcangeli aarcange@redhat.com
    Cc: "Kirill A. Shutemov" kirill.shutemov@linux.intel.com
    Cc: Rik van Riel riel@redhat.com
    Cc: Joonsoo Kim iamjoonsoo.kim@lge.com
    Cc: Mel Gorman mgorman@techsingularity.net
    Cc: David Rientjes rientjes@google.com
    Cc: Michal Hocko mhocko@suse.com
    Cc: Johannes Weiner hannes@cmpxchg.org
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit eeb68d1d2d48b5bfe9d79d8eac35df576bb79a99
Author: Frank Rowand frowand.list@gmail.com
Date:   Thu Apr 28 16:18:47 2016 -0700
.mailmap: add Frank Rowand
Set current email address to replace obsolete email addresses.
Signed-off-by: Frank Rowand frank.rowand@sonymobile.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit d7e69488bd04de165667f6bc741c1c0ec6042ab9
Author: Minchan Kim minchan@kernel.org
Date:   Thu Apr 28 16:18:44 2016 -0700
mm/hwpoison: fix wrong num_poisoned_pages accounting
Currently, migration code increses num_poisoned_pages on *failed*
    migration page as well as successfully migrated one at the trial of
    memory-failure.  It will make the stat wrong.  As well, it marks the
    page as PG_HWPoison even if the migration trial failed.  It would mean
    we cannot recover the corrupted page using memory-failure facility.
This patches fixes it.
Signed-off-by: Minchan Kim minchan@kernel.org
    Reported-by: Vlastimil Babka vbabka@suse.cz
    Acked-by: Naoya Horiguchi n-horiguchi@ah.jp.nec.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit b06bad17c7435b600a1d7a35b56eff25e1d3dbc0
Author: Minchan Kim minchan@kernel.org
Date:   Thu Apr 28 16:18:41 2016 -0700
mm: call swap_slot_free_notify() with page lock held
Kyeongdon reported below error which is BUG_ON(!PageSwapCache(page)) in
    page_swap_info.  The reason is that page_endio in rw_page unlocks the
    page if read I/O is completed so we need to hold a PG_lock again to
    check PageSwapCache.  Otherwise, the page can be removed from swapcache.
Kernel BUG at c00f9040 [verbose debug info unavailable]
      Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM
      Modules linked in:
      CPU: 4 PID: 13446 Comm: RenderThread Tainted: G        W 3.10.84-g9f14aec-dirty #73
      task: c3b73200 ti: dd192000 task.ti: dd192000
      PC is at page_swap_info+0x10/0x2c
      LR is at swap_slot_free_notify+0x18/0x6c
      pc : [<c00f9040>]    lr : [<c00f5560>]    psr: 400f0113
      sp : dd193d78  ip : c2deb1e4  fp : da015180
      r10: 00000000  r9 : 000200da  r8 : c120fe08
      r7 : 00000000  r6 : 00000000  r5 : c249a6c0  r4 : = c249a6c0
      r3 : 00000000  r2 : 40080009  r1 : 200f0113  r0 : = c249a6c0
      ..<snip> ..
      Call Trace:
        page_swap_info+0x10/0x2c
        swap_slot_free_notify+0x18/0x6c
        swap_readpage+0x90/0x11c
        read_swap_cache_async+0x134/0x1ac
        swapin_readahead+0x70/0xb0
        handle_pte_fault+0x320/0x6fc
        handle_mm_fault+0xc0/0xf0
        do_page_fault+0x11c/0x36c
        do_DataAbort+0x34/0x118
Fixes: 3f2b1a04f44933f2 ("zram: revive swap_slot_free_notify")
    Signed-off-by: Minchan Kim minchan@kernel.org
    Tested-by: Kyeongdon Kim kyeongdon.kim@lge.com
    Cc: Hugh Dickins hughd@google.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 7bf52fb891b64b8d61caf0b82060adb9db761aec
Author: Minchan Kim minchan@kernel.org
Date:   Thu Apr 28 16:18:38 2016 -0700
mm: vmscan: reclaim highmem zone if buffer_heads is over limit
We have been reclaimed highmem zone if buffer_heads is over limit but
    commit 6b4f7799c6a5 ("mm: vmscan: invoke slab shrinkers from
    shrink_zone()") changed the behavior so it doesn't reclaim highmem zone
    although buffer_heads is over the limit.  This patch restores the logic.
Fixes: 6b4f7799c6a5 ("mm: vmscan: invoke slab shrinkers from shrink_zone()")
    Signed-off-by: Minchan Kim minchan@kernel.org
    Cc: Johannes Weiner hannes@cmpxchg.org
    Cc: stable@vger.kernel.org
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 28093f9f34cedeaea0f481c58446d9dac6dd620f
Author: Gerald Schaefer gerald.schaefer@de.ibm.com
Date:   Thu Apr 28 16:18:35 2016 -0700
numa: fix /proc/<pid>/numa_maps for THP
In gather_pte_stats() a THP pmd is cast into a pte, which is wrong
    because the layouts may differ depending on the architecture.  On s390
    this will lead to inaccurate numa_maps accounting in /proc because of
    misguided pte_present() and pte_dirty() checks on the fake pte.
On other architectures pte_present() and pte_dirty() may work by chance,
    but there may be an issue with direct-access (dax) mappings w/o
    underlying struct pages when HAVE_PTE_SPECIAL is set and THP is
    available.  In vm_normal_page() the fake pte will be checked with
    pte_special() and because there is no "special" bit in a pmd, this will
    always return false and the VM_PFNMAP | VM_MIXEDMAP checking will be
    skipped.  On dax mappings w/o struct pages, an invalid struct page
    pointer would then be returned that can crash the kernel.
This patch fixes the numa_maps THP handling by introducing new "_pmd"
    variants of the can_gather_numa_stats() and vm_normal_page() functions.
Signed-off-by: Gerald Schaefer gerald.schaefer@de.ibm.com
    Cc: Naoya Horiguchi n-horiguchi@ah.jp.nec.com
    Cc: "Kirill A . Shutemov" kirill.shutemov@linux.intel.com
    Cc: Konstantin Khlebnikov koct9i@gmail.com
    Cc: Michal Hocko mhocko@suse.com
    Cc: Vlastimil Babka vbabka@suse.cz
    Cc: Jerome Marchand jmarchan@redhat.com
    Cc: Johannes Weiner hannes@cmpxchg.org
    Cc: Dave Hansen dave.hansen@intel.com
    Cc: Mel Gorman mgorman@suse.de
    Cc: Dan Williams dan.j.williams@intel.com
    Cc: Martin Schwidefsky schwidefsky@de.ibm.com
    Cc: Heiko Carstens heiko.carstens@de.ibm.com
    Cc: Michael Holzheu holzheu@linux.vnet.ibm.com
    Cc: stable@vger.kernel.org	[4.3+]
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 3486b85a29c1741db99d0c522211c82d2b7a56d0
Author: Konstantin Khlebnikov koct9i@gmail.com
Date:   Thu Apr 28 16:18:32 2016 -0700
mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check
Khugepaged detects own VMAs by checking vm_file and vm_ops but this way
    it cannot distinguish private /dev/zero mappings from other special
    mappings like /dev/hpet which has no vm_ops and popultes PTEs in mmap.
This fixes false-positive VM_BUG_ON and prevents installing THP where
    they are not expected.
Link: http://lkml.kernel.org/r/CACT4Y+ZmuZMV5CjSFOeXviwQdABAgT7T+StKfTqan9YDtgEi5g...
    Fixes: 78f11a255749 ("mm: thp: fix /dev/zero MAP_PRIVATE and vm_flags cleanups")
    Signed-off-by: Konstantin Khlebnikov koct9i@gmail.com
    Reported-by: Dmitry Vyukov dvyukov@google.com
    Acked-by: Vlastimil Babka vbabka@suse.cz
    Acked-by: Kirill A. Shutemov kirill.shutemov@linux.intel.com
    Cc: Dmitry Vyukov dvyukov@google.com
    Cc: Andrea Arcangeli aarcange@redhat.com
    Cc: stable stable@vger.kernel.org
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 314e9b75b3f673a61ecbf0bba401830bc7dfe121
Author: Krzysztof Kozlowski krzk@kernel.org
Date:   Thu Apr 28 16:18:30 2016 -0700
mailmap: fix Krzysztof Kozlowski's misspelled name
Patchwork introduced a garbled Polish character in commit 1e3012d0fdc5
    ("crypto: s5p-sss - Use memcpy_toio for iomem annotated memory") so fix
    the mail mapping.  Additionally prefer to use kernel.org account for
    personal work, instead of my gmail address.
Signed-off-by: Krzysztof Kozlowski krzk@kernel.org
    Cc: Herbert Xu herbert@gondor.apana.org.au
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit aa88b68c3b1dce8bc3fd54c8a7372a777ff265cd
Author: Kirill A. Shutemov kirill.shutemov@linux.intel.com
Date:   Thu Apr 28 16:18:27 2016 -0700
thp: keep huge zero page pinned until tlb flush
Andrea has found[1] a race condition on MMU-gather based TLB flush vs
    split_huge_page() or shrinker which frees huge zero under us (patch 1/2
    and 2/2 respectively).
With new THP refcounting, we don't need patch 1/2: mmu_gather keeps the
    page pinned until flush is complete and the pin prevents the page from
    being split under us.
We still need patch 2/2.  This is simplified version of Andrea's patch.
    We don't need fancy encoding.
[1] http://lkml.kernel.org/r/1447938052-22165-1-git-send-email-aarcange@redhat.c...
Signed-off-by: Kirill A. Shutemov kirill.shutemov@linux.intel.com
    Reported-by: Andrea Arcangeli aarcange@redhat.com
    Reviewed-by: Andrea Arcangeli aarcange@redhat.com
    Cc: "Aneesh Kumar K.V" aneesh.kumar@linux.vnet.ibm.com
    Cc: Mel Gorman mgorman@techsingularity.net
    Cc: Hugh Dickins hughd@google.com
    Cc: Johannes Weiner hannes@cmpxchg.org
    Cc: Dave Hansen dave.hansen@intel.com
    Cc: Vlastimil Babka vbabka@suse.cz
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 66ee95d16a7f1b7b4f1dd74a2d81c6e19dc29a14
Author: Steve Capper steve.capper@arm.com
Date:   Thu Apr 28 16:18:24 2016 -0700
mm: exclude HugeTLB pages from THP page_mapped() logic
HugeTLB pages cannot be split, so we use the compound_mapcount to track
    rmaps.
Currently page_mapped() will check the compound_mapcount, but will also
    go through the constituent pages of a THP compound page and query the
    individual _mapcount's too.
Unfortunately, page_mapped() does not distinguish between HugeTLB and
    THP compound pages and assumes that a compound page always needs to have
    HPAGE_PMD_NR pages querying.
For most cases when dealing with HugeTLB this is just inefficient, but
    for scenarios where the HugeTLB page size is less than the pmd block
    size (e.g.  when using contiguous bit on ARM) this can lead to crashes.
This patch adjusts the page_mapped function such that we skip the
    unnecessary THP reference checks for HugeTLB pages.
Fixes: e1534ae95004 ("mm: differentiate page_mapped() from page_mapcount() for compound pages")
    Signed-off-by: Steve Capper steve.capper@arm.com
    Acked-by: Kirill A. Shutemov kirill.shutemov@linux.intel.com
    Cc: Will Deacon will.deacon@arm.com
    Cc: Catalin Marinas catalin.marinas@arm.com
    Cc: Michal Hocko mhocko@suse.com
    Cc: Ingo Molnar mingo@kernel.org
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit d7f53518f713d3d9bf5ed150f943853fb94e7473
Author: Atsushi Kumagai ats-kumagai@wm.jp.nec.com
Date:   Thu Apr 28 16:18:21 2016 -0700
kexec: export OFFSET(page.compound_head) to find out compound tail page
PageAnon() always look at head page to check PAGE_MAPPING_ANON and tail
    page's page->mapping has just a poisoned data since commit 1c290f642101
    ("mm: sanitize page->mapping for tail pages").
If makedumpfile checks page->mapping of a compound tail page to
    distinguish anonymous page as usual, it must fail in newer kernel.  So
    it's necessary to export OFFSET(page.compound_head) to avoid checking
    compound tail pages.
The problem is that unnecessary hugepages won't be removed from a dump
    file in kernels 4.5.x and later.  This means that extra disk space would
    be consumed.  It's a problem, but not critical.
Signed-off-by: Atsushi Kumagai ats-kumagai@wm.jp.nec.com
    Acked-by: Dave Young dyoung@redhat.com
    Cc: "Eric W. Biederman" ebiederm@xmission.com
    Cc: Vivek Goyal vgoyal@redhat.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 8639a847b0e11f8d2daa3eafe15a9609c91fd357
Author: Atsushi Kumagai ats-kumagai@wm.jp.nec.com
Date:   Thu Apr 28 16:18:18 2016 -0700
kexec: update VMCOREINFO for compound_order/dtor
makedumpfile refers page.lru.next to get the order of compound pages for
    page filtering.
However, now the order is stored in page.compound_order, hence
    VMCOREINFO should be updated to export the offset of
    page.compound_order.
The fact is, page.compound_order was introduced already in kernel 4.0,
    but the offset of it was the same as page.lru.next until kernel 4.3, so
    this was not actual problem.
The above can be said also for page.lru.prev and page.compound_dtor,
    it's necessary to detect hugetlbfs pages.  Further, the content was
    changed from direct address to the ID which means dtor.
The problem is that unnecessary hugepages won't be removed from a dump
    file in kernels 4.4.x and later.  This means that extra disk space would
    be consumed.  It's a problem, but not critical.
Signed-off-by: Atsushi Kumagai ats-kumagai@wm.jp.nec.com
    Acked-by: Dave Young dyoung@redhat.com
    Cc: "Eric W. Biederman" ebiederm@xmission.com
    Cc: Vivek Goyal vgoyal@redhat.com
    Signed-off-by: Andrew Morton akpm@linux-foundation.org
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
commit 6fa9bffbccb91e07519e1deb05e001d191f0df43
Merge: cf681c2 d3767f0
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Thu Apr 28 18:59:24 2016 -0700
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client
Pull Ceph fixes from Sage Weil:
     "There is a lifecycle fix in the auth code, a fix for a narrow race
      condition on map, and a helpful message in the log when there is a
      feature mismatch (which happens frequently now that the default
      server-side options have changed)"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
      rbd: report unsupported features to syslog
      rbd: fix rbd map vs notify races
      libceph: make authorizer destruction independent of ceph_auth_client
commit cf681c2ebcb502ced998ca0659b2907b9ad9daf9
Merge: b75a2bf 532c34b5
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Thu Apr 28 18:52:11 2016 -0700
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Martin Schwidefsky:
     "Three more bug fixes for 4.6
- Due to a race in the dynamic page table code a multi-threaded
         program can cause a translation specification exception.  With
         panic_on_oops a user space program can crash the system.
- An information leak with the /dev/sclp device.
- A use after free in the s390 PCI code"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
      s390/sclp_ctl: fix potential information leak with /dev/sclp
      s390/mm: fix asce_bits handling with dynamic pagetable levels
      s390/pci: fix use after free in dma_init
commit 4c8bb95921e9ac01b9dd0c3abbaf6514ce88af92
Author: Florian Westphal fw@strlen.de
Date:   Sun Apr 24 22:18:59 2016 +0200
RDMA/nes: don't leak skb if carrier down
Alternatively one could free the skb, OTOH I don't think this test is
    useful so just remove it.
Cc: linux-rdma@vger.kernel.org
    Signed-off-by: Florian Westphal fw@strlen.de
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 7851496a32319237456919575e5f4ba62f74cc7d
Author: Sinclair Yeh syeh@vmware.com
Date:   Thu Apr 21 11:29:31 2016 -0700
drm/vmwgfx: Fix order of operation
mode->hdisplay * (var->bits_per_pixel + 7) gets evaluated before
    the division, potentially making the pitch larger than it should
    be.
Since the original intention is to do a div-round-up, just use
    the macro instead.
Signed-off-by: Sinclair Yeh syeh@vmware.com
    Reviewed-by: Thomas Hellstrom thellstrom@vmware.com
commit e02e58843153ce80a9fe7588def89b2638d40e64
Author: Charmaine Lee charmainel@vmware.com
Date:   Tue Apr 12 08:19:08 2016 -0700
drm/vmwgfx: use vmw_cmd_dx_cid_check for query commands.
Instead of calling vmw_cmd_ok, call vmw_cmd_dx_cid_check to
    validate the context id for query commands.
Signed-off-by: Charmaine Lee charmainel@vmware.com
    Reviewed-by: Sinclair Yeh syeh@vmware.com
commit 1883598d4201361a6d2ce785095695f58071ee11
Author: Charmaine Lee charmainel@vmware.com
Date:   Tue Apr 12 08:14:23 2016 -0700
drm/vmwgfx: Enable SVGA_3D_CMD_DX_SET_PREDICATION
Fixes piglit tests nv_conditional_render-* crashes.
Signed-off-by: Charmaine Lee charmainel@vmware.com
    Reviewed-by: Brian Paul brianp@vmware.com
    Reviewed-by: Sinclair Yeh syeh@vmware.com
commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3
Author: Jason Gunthorpe jgunthorpe@obsidianresearch.com
Date:   Sun Apr 10 19:13:13 2016 -0600
IB/security: Restrict use of the write() interface
The drivers/infiniband stack uses write() as a replacement for
    bi-directional ioctl().  This is not safe. There are ways to
    trigger write calls that result in the return structure that
    is normally written to user space being shunted off to user
    specified kernel memory instead.
For the immediate repair, detect and deny suspicious accesses to
    the write API.
For long term, update the user space libraries and the kernel API
    to something that doesn't present the same security vulnerabilities
    (likely a structured ioctl() interface).
The impacted uAPI interfaces are generally only available if
    hardware from drivers/infiniband is installed in the system.
Reported-by: Jann Horn jann@thejh.net
    Signed-off-by: Linus Torvalds torvalds@linux-foundation.org
    Signed-off-by: Jason Gunthorpe jgunthorpe@obsidianresearch.com
    [ Expanded check to all known write() entry points ]
    Cc: stable@vger.kernel.org
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 7723d8c2445c4dfa91f8df42703b56f8ade59af7
Author: Dean Luick dean.luick@intel.com
Date:   Fri Apr 22 11:17:03 2016 -0700
IB/hfi1: Use kernel default llseek for ui device
The ui device llseek had a mistake with SEEK_END and did
    not fully follow seek semantics.  Correct all this by
    using a kernel supplied function for fixed size devices.
Cc: Al Viro viro@ZenIV.linux.org.uk
    Reviewed-by: Dennis Dalessandro dennis.dalessandro@intel.com
    Signed-off-by: Dean Luick dean.luick@intel.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 94158442eb0c66bbb0b733999e108fa26a7673ef
Author: Mitko Haralanov mitko.haralanov@intel.com
Date:   Wed Apr 20 06:05:36 2016 -0700
IB/hfi1: Don't attempt to free resources if initialization failed
Attempting to free resources which have not been allocated and
    initialized properly led to the following kernel backtrace:
BUG: unable to handle kernel NULL pointer dereference at           (null)
        IP: [<ffffffffa09658fe>] unlock_exp_tids.isra.8+0x2e/0x120 [hfi1]
        PGD 852a43067 PUD 85d4a6067 PMD 0
        Oops: 0000 [#1] SMP
        CPU: 0 PID: 2831 Comm: osu_bw Tainted: G          IO 3.12.18-wfr+ #1
        task: ffff88085b15b540 ti: ffff8808588fe000 task.ti: ffff8808588fe000
        RIP: 0010:[<ffffffffa09658fe>]  [<ffffffffa09658fe>] unlock_exp_tids.isra.8+0x2e/0x120 [hfi1]
        RSP: 0018:ffff8808588ffde0  EFLAGS: 00010282
        RAX: 0000000000000000 RBX: ffff880858a31800 RCX: 0000000000000000
        RDX: ffff88085d971bc0 RSI: ffff880858a318f8 RDI: ffff880858a318c0
        RBP: ffff8808588ffe20 R08: 0000000000000000 R09: 0000000000000000
        R10: ffff88087ffd6f40 R11: 0000000001100348 R12: ffff880852900000
        R13: ffff880858a318c0 R14: 0000000000000000 R15: ffff88085d971be8
        FS:  00007f4674e83740(0000) GS:ffff88087f400000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000000000000 CR3: 000000085c377000 CR4: 00000000001407f0
        Stack:
         ffffffffa0941a71 ffff880858a318f8 ffff88085d971bc0 ffff880858a31800
         ffff880852900000 ffff880858a31800 00000000003ffff7 ffff88085d971bc0
         ffff8808588ffe60 ffffffffa09663fc ffff8808588ffe60 ffff880858a31800
        Call Trace:
         [<ffffffffa0941a71>] ? find_mmu_handler+0x51/0x70 [hfi1]
         [<ffffffffa09663fc>] hfi1_user_exp_rcv_free+0x6c/0x120 [hfi1]
         [<ffffffffa0932809>] hfi1_file_close+0x1a9/0x340 [hfi1]
         [<ffffffff8116c189>] __fput+0xe9/0x270
         [<ffffffff8116c35e>] ____fput+0xe/0x10
         [<ffffffff81065707>] task_work_run+0xa7/0xe0
         [<ffffffff81002969>] do_notify_resume+0x59/0x80
         [<ffffffff814ffc1a>] int_signal+0x12/0x17
This commit re-arranges the context initialization code in a way that
    would allow for context event flags to be used to determine whether
    the context has been successfully initialized.
In turn, this can be used to skip the resource de-allocation if they
    were never allocated in the first place.
Fixes: 3abb33ac6521 ("staging/hfi1: Add TID cache receive init and free funcs")
    Reviewed-by: Dennis Dalessandro dennis.dalessandro@intel.com
    Signed-off-by: Mitko Haralanov mitko.haralanov@intel.com
    Reviewed-by: Leon Romanovsky <leonro@mellanox.com.
    Signed-off-by: Doug Ledford dledford@redhat.com
commit b9b06cb6fedab10665a2d527464b45f332d17465
Author: Mike Marciniszyn mike.marciniszyn@intel.com
Date:   Wed Apr 20 06:05:30 2016 -0700
IB/hfi1: Fix missing lock/unlock in verbs drain callback
The iowait_sdma_drained() callback lacked locking to
    protect the qp s_flags field.
This causes the s_flags to be out of sync
    on multiple CPUs, potentially corrupting the s_flags.
Fixes: a545f5308b6c ("staging/rdma/hfi: fix CQ completion order issue")
    Reviewed-by: Sebastian Sanchez sebastian.sanchez@intel.com
    Signed-off-by: Mike Marciniszyn mike.marciniszyn@intel.com
    Reviewed-by: Leon Romanovsky leonro@mellanox.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit e6d2e0176e1f3c1e1534851b66c0b972f03ff069
Author: Jubin John jubin.john@intel.com
Date:   Tue Apr 12 10:47:00 2016 -0700
IB/rdmavt: Fix send scheduling
call_send is used to determine whether to send immediately or schedule
    a send for later. The current logic in rdmavt is inverted and has a
    negative impact on the latency of the hfi1 and qib drivers. Fix this
    regression by correctly calling send immediately when call_send is set.
Reviewed-by: Dennis Dalessandro dennis.dalessandro@intel.com
    Reviewed-by: Mike Marciniszyn mike.marciniszyn@intel.com
    Signed-off-by: Jubin John jubin.john@intel.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 849e3e9398608c26a7c54bf9fbf3288f7ced6bfb
Author: Mitko Haralanov mitko.haralanov@intel.com
Date:   Tue Apr 12 10:46:16 2016 -0700
IB/hfi1: Prevent unpinning of wrong pages
The routine used by the SDMA cache to handle already
    cached nodes can extend an already existing node.
In its error handling code, the routine will unpin pages
    when not all pages of the buffer extension were pinned.
There was a bug in that part of the routine, which would
    mistakenly unpin pages from the original set rather than
    the newly pinned pages.
This commit fixes that bug by offsetting the page array
    to the proper place pointing at the beginning of the newly
    pinned pages.
Reviewed-by: Dean Luick dean.luick@intel.com
    Signed-off-by: Mitko Haralanov mitko.haralanov@intel.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit de82bdff62a9078a6e4f1452e2f2604686e51e49
Author: Mitko Haralanov mitko.haralanov@intel.com
Date:   Tue Apr 12 10:46:03 2016 -0700
IB/hfi1: Fix deadlock caused by locking with wrong scope
The locking around the interval RB tree is designed to prevent
    access to the tree while it's being modified. The locking in its
    current form is too overzealous, which is causing a deadlock in
    certain cases with the following backtrace:
Kernel panic - not syncing: Watchdog detected hard LOCKUP on cpu 0
        CPU: 0 PID: 5836 Comm: IMB-MPI1 Tainted: G           O 3.12.18-wfr+ #1
         0000000000000000 ffff88087f206c50 ffffffff814f1caa ffffffff817b53f0
         ffff88087f206cc8 ffffffff814ecd56 0000000000000010 ffff88087f206cd8
         ffff88087f206c78 0000000000000000 0000000000000000 0000000000001662
        Call Trace:
         <NMI>  [<ffffffff814f1caa>] dump_stack+0x45/0x56
         [<ffffffff814ecd56>] panic+0xc2/0x1cb
         [<ffffffff810d4370>] ? restart_watchdog_hrtimer+0x50/0x50
         [<ffffffff810d4432>] watchdog_overflow_callback+0xc2/0xd0
         [<ffffffff81109b4e>] __perf_event_overflow+0x8e/0x2b0
         [<ffffffff8110a714>] perf_event_overflow+0x14/0x20
         [<ffffffff8101c906>] intel_pmu_handle_irq+0x1b6/0x390
         [<ffffffff814f927b>] perf_event_nmi_handler+0x2b/0x50
         [<ffffffff814f8ad8>] nmi_handle.isra.3+0x88/0x180
         [<ffffffff814f8d39>] do_nmi+0x169/0x310
         [<ffffffff814f8177>] end_repeat_nmi+0x1e/0x2e
         [<ffffffff81272600>] ? unmap_single+0x30/0x30
         [<ffffffff814f780d>] ? _raw_spin_lock_irqsave+0x2d/0x40
         [<ffffffff814f780d>] ? _raw_spin_lock_irqsave+0x2d/0x40
         [<ffffffff814f780d>] ? _raw_spin_lock_irqsave+0x2d/0x40
         <<EOE>>  <IRQ>  [<ffffffffa056c4a8>] hfi1_mmu_rb_search+0x38/0x70 [hfi1]
         [<ffffffffa05919cb>] user_sdma_free_request+0xcb/0x120 [hfi1]
         [<ffffffffa0593393>] user_sdma_txreq_cb+0x263/0x350 [hfi1]
         [<ffffffffa057fad7>] ? sdma_txclean+0x27/0x1c0 [hfi1]
         [<ffffffffa0593130>] ? user_sdma_send_pkts+0x1710/0x1710 [hfi1]
         [<ffffffffa057fdd6>] sdma_make_progress+0x166/0x480 [hfi1]
         [<ffffffff810762c9>] ? ttwu_do_wakeup+0x19/0xd0
         [<ffffffffa0581c7e>] sdma_engine_interrupt+0x8e/0x100 [hfi1]
         [<ffffffffa0546bdd>] sdma_interrupt+0x5d/0xa0 [hfi1]
         [<ffffffff81097e57>] handle_irq_event_percpu+0x47/0x1d0
         [<ffffffff81098017>] handle_irq_event+0x37/0x60
         [<ffffffff8109aa5f>] handle_edge_irq+0x6f/0x120
         [<ffffffff810044af>] handle_irq+0xbf/0x150
         [<ffffffff8104c9b7>] ? irq_enter+0x17/0x80
         [<ffffffff8150168d>] do_IRQ+0x4d/0xc0
         [<ffffffff814f7c6a>] common_interrupt+0x6a/0x6a
         <EOI>  [<ffffffff81073524>] ? finish_task_switch+0x54/0xe0
         [<ffffffff814f56c6>] __schedule+0x3b6/0x7e0
         [<ffffffff810763a6>] __cond_resched+0x26/0x30
         [<ffffffff814f5eda>] _cond_resched+0x3a/0x50
         [<ffffffff814f4f82>] down_write+0x12/0x30
         [<ffffffffa0591619>] hfi1_release_user_pages+0x69/0x90 [hfi1]
         [<ffffffffa059173a>] sdma_rb_remove+0x9a/0xc0 [hfi1]
         [<ffffffffa056c00d>] __mmu_rb_remove.isra.5+0x5d/0x70 [hfi1]
         [<ffffffffa056c536>] hfi1_mmu_rb_remove+0x56/0x70 [hfi1]
         [<ffffffffa059427b>] hfi1_user_sdma_process_request+0x74b/0x1160 [hfi1]
         [<ffffffffa055c763>] hfi1_aio_write+0xc3/0x100 [hfi1]
         [<ffffffff8116a14c>] do_sync_readv_writev+0x4c/0x80
         [<ffffffff8116b58b>] do_readv_writev+0xbb/0x230
         [<ffffffff811a9da1>] ? fsnotify+0x241/0x320
         [<ffffffff81073524>] ? finish_task_switch+0x54/0xe0
         [<ffffffff8116b795>] vfs_writev+0x35/0x60
         [<ffffffff8116b8c9>] SyS_writev+0x49/0xc0
         [<ffffffff810cd876>] ? __audit_syscall_exit+0x1f6/0x2a0
         [<ffffffff814ff992>] system_call_fastpath+0x16/0x1b
As evident from the backtrace above, the process was being put to sleep
    while holding the lock.
Limiting the scope of the lock only to the RB tree operation fixes the
    above error allowing for proper locking and the process being put to
    sleep when needed.
Reviewed-by: Dennis Dalessandro dennis.dalessandro@intel.com
    Reviewed-by: Dean Luick dean.luick@intel.com
    Signed-off-by: Mitko Haralanov mitko.haralanov@intel.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit f19bd643dbded8672bfeffe9e51322464e4a9239
Author: Mitko Haralanov mitko.haralanov@intel.com
Date:   Tue Apr 12 10:45:57 2016 -0700
IB/hfi1: Prevent NULL pointer deferences in caching code
There is a potential kernel crash when the MMU notifier calls the
    invalidation routines in the hfi1 pinned page caching code for sdma.
The invalidation routine could call the remove callback
    for the node, which in turn ends up dereferencing the
    current task_struct to get a pointer to the mm_struct.
    However, the mm_struct pointer could be NULL resulting in
    the following backtrace:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000a8
        IP: [<ffffffffa041f75a>] sdma_rb_remove+0xaa/0x100 [hfi1]
        15
        task: ffff88085e66e080 ti: ffff88085c244000 task.ti: ffff88085c244000
        RIP: 0010:[<ffffffffa041f75a>]  [<ffffffffa041f75a>] sdma_rb_remove+0xaa/0x100 [hfi1]
        RSP: 0000:ffff88085c245878  EFLAGS: 00010002
        RAX: 0000000000000000 RBX: ffff88105b9bbd40 RCX: ffffea003931a830
        RDX: 0000000000000004 RSI: ffff88105754a9c0 RDI: ffff88105754a9c0
        RBP: ffff88085c245890 R08: ffff88105b9bbd70 R09: 00000000fffffffb
        R10: ffff88105b9bbd58 R11: 0000000000000013 R12: ffff88105754a9c0
        R13: 0000000000000001 R14: 0000000000000001 R15: ffff88105b9bbd40
        FS:  0000000000000000(0000) GS:ffff88107ef40000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 00000000000000a8 CR3: 0000000001a0b000 CR4: 00000000001407e0
        Stack:
         ffff88105b9bbd40 ffff88080ec481a8 ffff88080ec481b8 ffff88085c2458c0
         ffffffffa03fa00e ffff88080ec48190 ffff88080ed9cd00 0000000001024000
         0000000000000000 ffff88085c245920 ffffffffa03fa0e7 0000000000000282
        Call Trace:
         [<ffffffffa03fa00e>] __mmu_rb_remove.isra.5+0x5e/0x70 [hfi1]
         [<ffffffffa03fa0e7>] mmu_notifier_mem_invalidate+0xc7/0xf0 [hfi1]
         [<ffffffffa03fa143>] mmu_notifier_page+0x13/0x20 [hfi1]
         [<ffffffff81156dd0>] __mmu_notifier_invalidate_page+0x50/0x70
         [<ffffffff81140bbb>] try_to_unmap_one+0x20b/0x470
         [<ffffffff81141ee7>] try_to_unmap_anon+0xa7/0x120
         [<ffffffff81141fad>] try_to_unmap+0x4d/0x60
         [<ffffffff8111fd7b>] shrink_page_list+0x2eb/0x9d0
         [<ffffffff81120ab3>] shrink_inactive_list+0x243/0x490
         [<ffffffff81121491>] shrink_lruvec+0x4c1/0x640
         [<ffffffff81121641>] shrink_zone+0x31/0x100
         [<ffffffff81121b0f>] kswapd_shrink_zone.constprop.62+0xef/0x1c0
         [<ffffffff811229e3>] kswapd+0x403/0x7e0
         [<ffffffff811225e0>] ? shrink_all_memory+0xf0/0xf0
         [<ffffffff81068ac0>] kthread+0xc0/0xd0
         [<ffffffff81068a00>] ? insert_kthread_work+0x40/0x40
         [<ffffffff814ff8ec>] ret_from_fork+0x7c/0xb0
         [<ffffffff81068a00>] ? insert_kthread_work+0x40/0x40
To correct this, the mm_struct passed to us by the MMU notifier is
    used (which is what should have been done to begin with). This avoids
    the broken derefences and ensures that the correct mm_struct is used.
Reviewed-by: Dennis Dalessandro dennis.dalessandro@intel.com
    Reviewed-by: Dean Luick dean.luick@intel.com
    Signed-off-by: Mitko Haralanov mitko.haralanov@intel.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit e7d2c25d94bf4bb6f73d185e5514414a15a56f46
Author: Sagi Grimberg sagi@grimberg.me
Date:   Sun Apr 3 15:03:12 2016 +0300
MAINTAINERS: Update iser/isert maintainer contact info
Signed-off-by: Sagi Grimberg sagi@grimberg.me
    Acked-by: Nicholas Bellinger nab@linux-iscsi.org
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 986ef95ecdd3eb6fa29433e68faa94c7624083be
Author: Sagi Grimberg sagi@grimberg.me
Date:   Thu Mar 31 19:03:25 2016 +0300
IB/mlx5: Expose correct max_sge_rd limit
mlx5 devices (Connect-IB, ConnectX-4, ConnectX-4-LX) has a limitation
    where rdma read work queue entries cannot exceed 512 bytes.
    A rdma_read wqe needs to fit in 512 bytes:
    - wqe control segment (16 bytes)
    - rdma segment (16 bytes)
    - scatter elements (16 bytes each)
So max_sge_rd should be: (512 - 16 - 16) / 16 = 30.
Cc: linux-stable@vger.kernel.org
    Reported-by: Christoph Hellwig hch@lst.de
    Tested-by: Christoph Hellwig hch@lst.de
    Signed-off-by: Sagi Grimberg sagig@grimberg.me
    Signed-off-by: Leon Romanovsky leonro@mellanox.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 2963070a0f8184fe40be11927344e3fcc7e18e7c
Author: Chen-Yu Tsai wens@csie.org
Date:   Tue Apr 26 23:37:26 2016 +0800
mmc: sunxi: Disable eMMC HS-DDR (MMC_CAP_1_8V_DDR) for Allwinner A80
eMMC HS-DDR no longer works on the A80, despite it working when support
    for this developed.
Disable it for now.
Signed-off-by: Chen-Yu Tsai wens@csie.org
    Signed-off-by: Ulf Hansson ulf.hansson@linaro.org
commit cf3beb7c90a8efa16a06b26634cddddc92bb819c
Author: Kan Liang kan.liang@intel.com
Date:   Thu Apr 21 02:30:10 2016 -0700
perf/x86/intel: Fix incorrect lbr_sel_mask value
This patch fixes a bug which was introduced by:
b16a5b52eb90 ("perf/x86: Add option to disable reading branch flags/cycles")
In this patch, lbr_sel_mask is used to mask the lbr_select. But LBR_SEL_MASK
    doesn't include the bit for LBR_CALL_STACK. So LBR call stack will never be
    set in lbr_select.
This patch corrects the LBR_SEL_MASK by including all valid bits in
    LBR_SELECT. Also, the LBR_CALL_STACK bit is different as other bit in
    LBR_SELECT. It does not operate in suppress mode, so it needs to be
    specially handled in intel_pmu_setup_hw_lbr_filter.
Signed-off-by: Kan Liang kan.liang@intel.com
    Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org
    Cc: Alexander Shishkin alexander.shishkin@linux.intel.com
    Cc: Arnaldo Carvalho de Melo acme@redhat.com
    Cc: Jiri Olsa jolsa@redhat.com
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Stephane Eranian eranian@google.com
    Cc: Thomas Gleixner tglx@linutronix.de
    Cc: Vince Weaver vincent.weaver@maine.edu
    Link: http://lkml.kernel.org/r/1461231010-4399-1-git-send-email-kan.liang@intel.co...
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit 1c5ac21a0e9bab7fc45d0ba9e11623e9ad99d02e
Author: Alexander Shishkin alexander.shishkin@linux.intel.com
Date:   Tue Mar 29 17:43:10 2016 +0300
perf/x86/intel/pt: Don't die on VMXON
Some versions of Intel PT do not support tracing across VMXON, more
    specifically, VMXON will clear TraceEn control bit and any attempt to
    set it before VMXOFF will throw a #GP, which in the current state of
    things will crash the kernel. Namely:
$ perf record -e intel_pt// kvm -nographic
on such a machine will kill it.
To avoid this, notify the intel_pt driver before VMXON and after
    VMXOFF so that it knows when not to enable itself.
Signed-off-by: Alexander Shishkin alexander.shishkin@linux.intel.com
    Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org
    Cc: Arnaldo Carvalho de Melo acme@infradead.org
    Cc: Arnaldo Carvalho de Melo acme@redhat.com
    Cc: Borislav Petkov bp@alien8.de
    Cc: Gleb Natapov gleb@kernel.org
    Cc: Jiri Olsa jolsa@redhat.com
    Cc: Paolo Bonzini pbonzini@redhat.com
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Stephane Eranian eranian@google.com
    Cc: Thomas Gleixner tglx@linutronix.de
    Cc: Vince Weaver vincent.weaver@maine.edu
    Cc: hpa@zytor.com
    Link: http://lkml.kernel.org/r/87oa9dwrfk.fsf@ashishki-desk.ger.corp.intel.com
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit 79c9ce57eb2d5f1497546a3946b4ae21b6fdc438
Author: Peter Zijlstra peterz@infradead.org
Date:   Tue Apr 26 11:36:53 2016 +0200
perf/core: Fix perf_event_open() vs. execve() race
Jann reported that the ptrace_may_access() check in
    find_lively_task_by_vpid() is racy against exec().
Specifically:
perf_event_open()		execve()
ptrace_may_access()
    				commit_creds()
      ...				if (get_dumpable() != SUID_DUMP_USER)
    				  perf_event_exit_task();
      perf_install_in_context()
would result in installing a counter across the creds boundary.
Fix this by wrapping lots of perf_event_open() in cred_guard_mutex.
    This should be fine as perf_event_exit_task() is already called with
    cred_guard_mutex held, so all perf locks already nest inside it.
Reported-by: Jann Horn jannh@google.com
    Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org
    Cc: Alexander Shishkin alexander.shishkin@linux.intel.com
    Cc: Arnaldo Carvalho de Melo acme@redhat.com
    Cc: Jiri Olsa jolsa@redhat.com
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Stephane Eranian eranian@google.com
    Cc: Thomas Gleixner tglx@linutronix.de
    Cc: Vince Weaver vincent.weaver@maine.edu
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit 0a25556f84d5f79e68e9502bb1f32a43377ab2bf
Author: Adam Borowski kilobyte@angband.pl
Date:   Wed Apr 27 11:35:31 2016 +0200
perf/x86/amd: Set the size of event map array to PERF_COUNT_HW_MAX
The entry for PERF_COUNT_HW_REF_CPU_CYCLES is not used on AMD, but is
    referenced by filter_events() which expects undefined events to have a
    value of 0.
Found via KASAN:
UBSAN: Undefined behaviour in arch/x86/events/amd/core.c:132:30
      index 9 is out of range for type 'u64 [9]'
      UBSAN: Undefined behaviour in arch/x86/events/amd/core.c:132:9
      load of address ffffffff81c021c8 with insufficient space for an object of type 'const u64'
Signed-off-by: Adam Borowski kilobyte@angband.pl
    Cc: Alexander Shishkin alexander.shishkin@linux.intel.com
    Cc: Arnaldo Carvalho de Melo acme@redhat.com
    Cc: Borislav Petkov bp@suse.de
    Cc: Jiri Olsa jolsa@redhat.com
    Cc: Mike Galbraith efault@gmx.de
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Stephane Eranian eranian@google.com
    Cc: Thomas Gleixner tglx@linutronix.de
    Cc: Vince Weaver vincent.weaver@maine.edu
    Link: http://lkml.kernel.org/r/1461749731-30979-1-git-send-email-kilobyte@angband....
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit d3767f0faeda5abdf205f947ae912d48dc70fa06
Author: Ilya Dryomov idryomov@gmail.com
Date:   Wed Apr 13 14:15:50 2016 +0200
rbd: report unsupported features to syslog
... instead of just returning an error.
Signed-off-by: Ilya Dryomov idryomov@gmail.com
    Reviewed-by: Josh Durgin jdurgin@redhat.com
commit 811c6688774613a78bfa020f64b570b73f6974c8
Author: Ilya Dryomov idryomov@gmail.com
Date:   Fri Apr 15 16:22:16 2016 +0200
rbd: fix rbd map vs notify races
A while ago, commit 9875201e1049 ("rbd: fix use-after free of
    rbd_dev->disk") fixed rbd unmap vs notify race by introducing
    an exported wrapper for flushing notifies and sticking it into
    do_rbd_remove().
A similar problem exists on the rbd map path, though: the watch is
    registered in rbd_dev_image_probe(), while the disk is set up quite
    a few steps later, in rbd_dev_device_setup().  Nothing prevents
    a notify from coming in and crashing on a NULL rbd_dev->disk:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
        Call Trace:
         [<ffffffffa0508344>] rbd_watch_cb+0x34/0x180 [rbd]
         [<ffffffffa04bd290>] do_event_work+0x40/0xb0 [libceph]
         [<ffffffff8109d5db>] process_one_work+0x17b/0x470
         [<ffffffff8109e3ab>] worker_thread+0x11b/0x400
         [<ffffffff8109e290>] ? rescuer_thread+0x400/0x400
         [<ffffffff810a5acf>] kthread+0xcf/0xe0
         [<ffffffff810b41b3>] ? finish_task_switch+0x53/0x170
         [<ffffffff810a5a00>] ? kthread_create_on_node+0x140/0x140
         [<ffffffff81645dd8>] ret_from_fork+0x58/0x90
         [<ffffffff810a5a00>] ? kthread_create_on_node+0x140/0x140
        RIP  [<ffffffffa050828a>] rbd_dev_refresh+0xfa/0x180 [rbd]
If an error occurs during rbd map, we have to error out, potentially
    tearing down a watch.  Just like on rbd unmap, notifies have to be
    flushed, otherwise rbd_watch_cb() may end up trying to read in the
    image header after rbd_dev_image_release() has run:
Assertion failure in rbd_dev_header_info() at line 4722:
rbd_assert(rbd_image_format_valid(rbd_dev->image_format));
Call Trace:
         [<ffffffff81cccee0>] ? rbd_parent_request_create+0x150/0x150
         [<ffffffff81cd4e59>] rbd_dev_refresh+0x59/0x390
         [<ffffffff81cd5229>] rbd_watch_cb+0x69/0x290
         [<ffffffff81fde9bf>] do_event_work+0x10f/0x1c0
         [<ffffffff81107799>] process_one_work+0x689/0x1a80
         [<ffffffff811076f7>] ? process_one_work+0x5e7/0x1a80
         [<ffffffff81132065>] ? finish_task_switch+0x225/0x640
         [<ffffffff81107110>] ? pwq_dec_nr_in_flight+0x2b0/0x2b0
         [<ffffffff81108c69>] worker_thread+0xd9/0x1320
         [<ffffffff81108b90>] ? process_one_work+0x1a80/0x1a80
         [<ffffffff8111b02d>] kthread+0x21d/0x2e0
         [<ffffffff8111ae10>] ? kthread_stop+0x550/0x550
         [<ffffffff82022802>] ret_from_fork+0x22/0x40
         [<ffffffff8111ae10>] ? kthread_stop+0x550/0x550
        RIP  [<ffffffff81ccd8f9>] rbd_dev_header_info+0xa19/0x1e30
To fix this, a) check if RBD_DEV_FLAG_EXISTS is set before calling
    revalidate_disk(), b) move ceph_osdc_flush_notifies() call into
    rbd_dev_header_unwatch_sync() to cover rbd map error paths and c) turn
    header read-in into a critical section.  The latter also happens to
    take care of rbd map foo@bar vs rbd snap rm foo@bar race.
Fixes: http://tracker.ceph.com/issues/15490
Signed-off-by: Ilya Dryomov idryomov@gmail.com
    Reviewed-by: Josh Durgin jdurgin@redhat.com
commit 1bdb8970392a68489b469c3a330a1adb5ef61beb
Author: Keith Busch keith.busch@intel.com
Date:   Wed Apr 27 14:22:32 2016 -0600
x86/apic: Handle zero vector gracefully in clear_vector_irq()
If x86_vector_alloc_irq() fails x86_vector_free_irqs() is invoked to cleanup
    the already allocated vectors. This subsequently calls clear_vector_irq().
The failed irq has no vector assigned, which triggers the BUG_ON(!vector) in
    clear_vector_irq().
We cannot suppress the call to x86_vector_free_irqs() for the failed
    interrupt, because the other data related to this irq must be cleaned up as
    well. So calling clear_vector_irq() with vector == 0 is legitimate.
Remove the BUG_ON and return if vector is zero,
[ tglx: Massaged changelog ]
Fixes: b5dc8e6c21e7 "x86/irq: Use hierarchical irqdomain to manage CPU interrupt vectors"
    Signed-off-by: Keith Busch keith.busch@intel.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Thomas Gleixner tglx@linutronix.de
commit 15333e3af1de37b1b214b28c85fe9a7b257fb92c
Author: Leo Yan leo.yan@linaro.org
Date:   Tue Mar 29 19:24:15 2016 +0800
thermal: use %d to print S32 parameters
Power allocator's parameters are S32 type, so use %d to print them.
Acked-by: Javi Merino javi.merino@arm.com
    Signed-off-by: Leo Yan leo.yan@linaro.org
    Signed-off-by: Eduardo Valentin edubezval@gmail.com
commit 5fdfc48bb0da2aa8a912024a6ecca06486eb9141
Author: Leo Yan leo.yan@linaro.org
Date:   Tue Mar 29 19:23:32 2016 +0800
thermal: hisilicon: increase temperature resolution
When calculate temperature, old code firstly do division and then
    convert to "millicelsius" unit. This will lose resolution and only can
    read back temperature with "Celsius" unit.
So firstly scale step value to "millicelsius" and then do division, so
    finally we can increase resolution for temperature value. Also refine
    the calculation from temperature value to step value.
Signed-off-by: Leo Yan leo.yan@linaro.org
    Signed-off-by: Eduardo Valentin edubezval@gmail.com
commit 49fa5230462f9f2c4e97c81356473a6bdf06c422
Author: David S. Miller davem@davemloft.net
Date:   Wed Apr 27 17:27:37 2016 -0400
sparc64: Fix bootup regressions on some Kconfig combinations.
The system call tracing bug fix mentioned in the Fixes tag
    below increased the amount of assembler code in the sequence
    of assembler files included by head_64.S
This caused to total set of code to exceed 0x4000 bytes in
    size, which overflows the expression in head_64.S that works
    to place swapper_tsb at address 0x408000.
When this is violated, the TSB is not properly aligned, and
    also the trap table is not aligned properly either.  All of
    this together results in failed boots.
So, do two things:
1) Simplify some code by using ba,a instead of ba/nop to get
       those bytes back.
2) Add a linker script assertion to make sure that if this
       happens again the build will fail.
Fixes: 1a40b95374f6 ("sparc: Fix system call tracing register handling.")
    Reported-by: Meelis Roos mroos@linux.ee
    Reported-by: Joerg Abraham joerg.abraham@nokia.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit b75a2bf899b668b1d52de8846aafdbcf81349c73
Merge: 763cfc8 346c09f
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Wed Apr 27 12:03:59 2016 -0700
Merge branch 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
Pull workqueue fix from Tejun Heo:
     "So, it turns out we had a silly bug in the most fundamental part of
      workqueue for a very long time.  AFAICS, this dates back to pre-git
      era and has quite likely been there from the time workqueue was first
      introduced.
A work item uses its PENDING bit to synchronize multiple queuers.
      Anyone who wins the PENDING bit owns the pending state of the work
      item.  Whether a queuer wins or loses the race, one thing should be
      guaranteed - there will soon be at least one execution of the work
      item - where "after" means that the execution instance would be able
      to see all the changes that the queuer has made prior to the queueing
      attempt.
Unfortunately, we were missing a smp_mb() after clearing PENDING for
      execution, so nothing guaranteed visibility of the changes that a
      queueing loser has made, which manifested as a reproducible blk-mq
      stall.
Lots of kudos to Roman for debugging the problem.  The patch for
      -stable is the minimal one.  For v3.7, Peter is working on a patch to
      make the code path slightly more efficient and less fragile"
* 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
      workqueue: fix ghost PENDING flag while doing MQ IO
commit 763cfc86ee8fd728a7cf2334b8d3a897af7a7ade
Merge: 3118e5f 264a0ae
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Wed Apr 27 11:41:14 2016 -0700
Merge branch 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fixes from Tejun Heo:
     "Two patches to fix a deadlock which can be easily triggered if memcg
      charge moving is used.
This bug was introduced while converting threadgroup locking to a
      global percpu_rwsem and is caused by cgroup controller task migration
      path depending on the ability to create new kthreads.  cpuset had a
      similar issue which was fixed by performing heavy-lifting operations
      asynchronous to task migration.  The two patches fix the same issue in
      memcg in a similar way.  The first patch makes the mechanism generic
      and the second relocates memcg charge moving outside the migration
      path.
Given that we don't want to perform heavy operations while
      writelocking threadgroup lock anyway, moving them out of the way is a
      desirable solution.  One thing to note is that the problem was
      difficult to debug because lockdep couldn't figure out the deadlock
      condition.  Looking into how to improve that"
* 'for-4.6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
      memcg: relocate charge moving from ->attach to ->post_attach
      cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback
commit 3118e5f966298c94efb0aade318e8ae463fab714
Merge: 24131a6 10ff4c5
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Wed Apr 27 11:34:45 2016 -0700
Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux
Pull i2c fixes from Wolfram Sang:
     "I2C has one buildfix, one ABBA deadlock fix, and three simple 'add ID'
      patches"
* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
      i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
      i2c: cpm: Fix build break due to incompatible pointer types
      i2c: ismt: Add Intel DNV PCI ID
      i2c: xlp9xx: add support for Broadcom Vulcan
      i2c: rk3x: add support for rk3228
commit 24131a61ec8c2d83431cb818281d3c9db986ab08
Merge: 508fea7 1b10cb2
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Wed Apr 27 09:46:21 2016 -0700
Merge tag 'arc-4.6-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc
Pull ARC fixes from Vineet Gupta:
- lockdep now works for ARCv2 builds
- enable DT reserved-memory binding (for forthcoming HDMI driver)
* tag 'arc-4.6-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
      ARC: add support for reserved memory defined by device tree
      ARC: support generic per-device coherent dma mem
      Documentation: dt: arc: fix spelling mistakes
      ARCv2: Enable LOCKDEP
commit 508fea71c6b2108ce81814a58fbc8c8aaf5e430f
Merge: 9453203 a8950e4
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Wed Apr 27 09:33:24 2016 -0700
Merge tag 'nios2-v4.6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2
Pull arch/nios2 fix from Ley Foon Tan:
     "memset: use the right constraint modifier for the %4 output operand"
* tag 'nios2-v4.6-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/lftan/nios2:
      nios2: memset: use the right constraint modifier for the %4 output operand
commit afc4542105f2b5a3bc6f0f3530d7ccbc94ca90fb
Author: Flora Cui Flora.Cui@amd.com
Date:   Mon Apr 25 16:06:17 2016 +0800
drm/amdgpu: disable vm interrupts with vm_fault_stop=2
V2: disable all vm interrupts in late_init()
Signed-off-by: Flora Cui Flora.Cui@amd.com
    Reviewed-by: Ken Wang Qingqing.Wang@amd.com
    Reviewed-by: Christian König christian.koenig@amd.com
    Signed-off-by: Alex Deucher alexander.deucher@amd.com
commit c8791a13d28161a1fa1138112dfe1f986a1358cf
Author: Alex Deucher alexander.deucher@amd.com
Date:   Mon Apr 25 13:14:47 2016 -0400
drm/amdgpu: print a message if ATPX dGPU power control is missing
It will help identify problematic boards.
Signed-off-by: Alex Deucher alexander.deucher@amd.com
commit e9bef455af8eb0e837e179aab8988ae2649fd8d3
Author: Alex Deucher alexander.deucher@amd.com
Date:   Mon Apr 25 13:12:18 2016 -0400
Revert "drm/amdgpu: disable runtime pm on PX laptops without dGPU power control"
This reverts commit bedf2a65c1aa8fb29ba8527fd00c0f68ec1f55f1.
See the radeon revert for an extended description.
Cc: stable@vger.kernel.org
commit 5d5b7803c49bbb01bdf4c6e95e8314d0515b9484
Author: Vitaly Prosyak vitaly.prosyak@amd.com
Date:   Thu Apr 14 13:34:03 2016 -0400
drm/radeon: fix vertical bars appear on monitor (v2)
When crtc/timing is disabled on boot the dig block
    should be stopped in order ignore timing from crtc,
    reset the steering fifo otherwise we get display
    corruption or hung in dp sst mode.
v2: agd: fix coding style
Signed-off-by: Vitaly Prosyak vitaly.prosyak@amd.com
    Signed-off-by: Alex Deucher alexander.deucher@amd.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Alex Deucher alexander.deucher@amd.com
commit 56fc350224f16901db709cd8cba86bac751aa2a2
Author: Flora Cui Flora.Cui@amd.com
Date:   Wed Apr 20 10:23:47 2016 +0800
drm/ttm: fix kref count mess in ttm_bo_move_to_lru_tail
Fixes the following scenario:
1. Page table bo allocated in vram and linked to man->lru.
       tbo->list_kref.refcount=2
    2. Page table bo is swapped out and removed from man->lru.
       tbo->list_kref.refcount=1
    3. Command submission from userspace.  Page table bo is moved
       to vram.  ttm_bo_move_to_lru_tail() link it to man->lru and
       don't increase the kref count.
Reviewed-by: Thomas Hellstrom thellstrom@vmware.com
    Signed-off-by: Flora Cui Flora.Cui@amd.com
    Reviewed-by: Christian König christian.koenig@amd.com
    Signed-off-by: Alex Deucher alexander.deucher@amd.com
    Cc: stable@vger.kernel.org
commit 9453203bf868a9b36227c961c68c8892c7262355
Merge: f28f20d a30b8f8
Author: Linus Torvalds torvalds@linux-foundation.org
Date:   Wed Apr 27 08:57:11 2016 -0700
Merge tag 'platform-drivers-x86-v4.6-3' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86
Pull x86 platform driver fix from Darren Hart:
     "Fix regression caused by hotkey enabling value in toshiba_acpi"
* tag 'platform-drivers-x86-v4.6-3' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86:
      toshiba_acpi: Fix regression caused by hotkey enabling value
commit af9cc93c0dee5fc1f9fa32cd9d79a456738a21be
Merge: bb03ed2 8c0f551
Author: Takashi Iwai tiwai@suse.de
Date:   Wed Apr 27 17:30:49 2016 +0200
Merge tag 'asoc-fix-v4.6-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v4.6
This is a fairly large collection of fixes but almost all driver
    specific ones, especially to the new Intel drivers which have had a lot
    of recent development.  The one core fix is a change to the debugfs code
    to avoid crashes in some relatively unusual configurations.
commit 1b10cb21d888c021bedbe678f7c26aee1bf04ffa
Author: Alexey Brodkin Alexey.Brodkin@synopsys.com
Date:   Tue Apr 26 19:29:34 2016 +0300
ARC: add support for reserved memory defined by device tree
Enable reserved memory initialization from device tree.
Signed-off-by: Alexey Brodkin abrodkin@synopsys.com
    Cc: Grant Likely grant.likely@linaro.org
    Cc: Marek Szyprowski m.szyprowski@samsung.com
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Vineet Gupta vgupta@synopsys.com
commit 32ed9a0e0ddcf58ef343bcb6ae44ee60d1ee31ce
Author: Alexey Brodkin Alexey.Brodkin@synopsys.com
Date:   Tue Apr 26 19:29:33 2016 +0300
ARC: support generic per-device coherent dma mem
Signed-off-by: Alexey Brodkin abrodkin@synopsys.com
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Vineet Gupta vgupta@synopsys.com
commit a8950e49bd241dc9ad90c24e92e23e95dbe9f018
Author: Romain Perier romain.perier@free-electrons.com
Date:   Tue Apr 19 18:17:32 2016 +0800
nios2: memset: use the right constraint modifier for the %4 output operand
Depending on the size of the area to be memset'ed, the nios2 memset implementation
    either uses a naive loop (for buffers smaller or equal than 8 bytes) or a more optimized
    implementation (for buffers larger than 8 bytes). This implementation does 4-byte stores
    rather than 1-byte stores to speed up memset.
However, we discovered that on our nios2 platform, memset() was not properly setting the
    buffer to the expected value. A memset of 0xff would not set the entire buffer to 0xff, but to:
0xff 0x00 0xff 0x00 0xff 0x00 0xff 0x00 ...
Which is obviously incorrect. Our investigation has revealed that the problem lies in the
    incorrect constraints used in the inline assembly.
The following piece of assembly, from the nios2 memset implementation, is supposed to
    create a 4-byte value that repeats 4 times the 1-byte pattern passed as memset argument:
/* fill8 %3, %5 (c & 0xff) */
    "       slli    %4, %5, 8\n"
    "       or      %4, %4, %5\n"
    "       slli    %3, %4, 16\n"
    "       or      %3, %3, %4\n"
However, depending on the compiler and optimization level, this code might be compiled as:
34:	280a923a 	slli	r5,r5,8
    38:	294ab03a 	or	r5,r5,r5
    3c:	2808943a 	slli	r4,r5,16
    40:	2148b03a 	or	r4,r4,r5
This is wrong because r5 gets used both for %5 and %4, which leads to the final pattern
    stored in r4 to be 0xff00ff00 rather than the expected 0xffffffff.
%4 is defined with the "=r" constraint, i.e as an output operand. However, as explained in
    http://www.ethernut.de/en/documents/arm-inline-asm.html, this does not prevent gcc from
    using the same register for an output operand (%4) and input operand (%5). By using the
    constraint modifier '&', we indicate that the register should be used for output only. With this
    change, we get the following assembly output:
34:	2810923a 	slli	r8,r5,8
    38:	4150b03a 	or	r8,r8,r5
    3c:	400e943a 	slli	r7,r8,16
    40:	3a0eb03a 	or	r7,r7,r8
Which correctly produces the 0xffffffff pattern when 0xff is passed as the memset() pattern.
It is worth mentioning the observed consequence of this bug: we were hitting the kernel
    BUG() in mm/bootmem.c:__free() that verifies when marking a page as free that it was
    previously marked as occupied (i.e that the bit was set to 1). The entire bootmem bitmap is
    set to 0xff bit via a memset() during the bootmem initialization. The bootmem_free() call right
    after the initialization was finding some bits to be set to 0, which didn't make sense since the
    bitmap has just been memset'ed to 0xff. Except that due to the bug explained above, the
    bitmap was in fact initialized to 0xff00ff00.
Thanks to Marek Vasut for his help and feedback.
Signed-off-by: Romain Perier romain.perier@free-electrons.com
    Acked-by: Marek Vasut marex@denx.de
    Acked-by: Ley Foon Tan lftan@altera.com
commit 532c34b5fbf1687df63b3fcd5b2846312ac943c6
Author: Martin Schwidefsky schwidefsky@de.ibm.com
Date:   Mon Apr 25 17:54:28 2016 +0200
s390/sclp_ctl: fix potential information leak with /dev/sclp
The sclp_ctl_ioctl_sccb function uses two copy_from_user calls to
    retrieve the sclp request from user space. The first copy_from_user
    fetches the length of the request which is stored in the first two
    bytes of the request. The second copy_from_user gets the complete
    sclp request, but this copies the length field a second time.
    A malicious user may have changed the length in the meantime.
Reported-by: Pengfei Wang wpengfeinudt@gmail.com
    Reviewed-by: Michael Holzheu holzheu@linux.vnet.ibm.com
    Signed-off-by: Martin Schwidefsky schwidefsky@de.ibm.com
commit d701cca6744fe0d67c86346dcfc9b128b17b5045
Author: Rui Salvaterra rsalvaterra@gmail.com
Date:   Tue Apr 19 13:23:36 2016 +0100
powerpc: wire up preadv2 and pwritev2 syscalls
Wire up preadv2/pwritev2 in the same way as preadv/pwritev. Fixes two
    build warnings on ppc64.
mpe: Lightly tested with fio (slightly hacked to add the syscall
    wrappers):
fio-4217  [009] ....  1304.635300: sys_preadv2(fd: 3, vec:
      10025821de0, vlen: 1, pos_l: 6253000, pos_h: 0, flags: 1)
      fio-4217  [009] ....  1304.635474: sys_preadv2 -> 0x1000
Signed-off-by: Rui Salvaterra rsalvaterra@gmail.com
    Signed-off-by: Michael Ellerman mpe@ellerman.id.au
commit 2bc79ffcbb817873cc43d63118008ab75181b73d
Author: Michael Neuling mikey@neuling.org
Date:   Fri Apr 22 14:57:49 2016 +1000
cxl: Poll for outstanding IRQs when detaching a context
When detaching contexts, we may still have interrupts in the system
    which are yet to be delivered to any CPU and be acked in the PSL.
    This can result in a subsequent unrelated process getting an spurious
    IRQ or an interrupt for a non-existent context.
This polls the PSL to ensure that the PSL is clear of IRQs for the
    detached context, before removing the context from the idr.
Signed-off-by: Michael Neuling mikey@neuling.org
    Tested-by: Andrew Donnellan andrew.donnellan@au1.ibm.com
    Acked-by: Ian Munsie imunsie@au1.ibm.com
    Tested-by: Vaibhav Jain vaibhav@linux.vnet.ibm.com
    Signed-off-by: Michael Ellerman mpe@ellerman.id.au
commit d6776bba44d9752f6cdf640046070e71ee4bba7b
Author: Michael Neuling mikey@neuling.org
Date:   Fri Apr 22 14:57:48 2016 +1000
cxl: Keep IRQ mappings on context teardown
Keep IRQ mappings on context teardown.  This won't leak IRQs as if we
    allocate the mapping again, the generic code will give the same
    mapping used last time.
Doing this works around a race in the generic code. Masking the
    interrupt introduces a race which can crash the kernel or result in
    IRQ that is never EOIed. The lost of EOI results in all subsequent
    mappings to the same HW IRQ never receiving an interrupt.
We've seen this race with cxl test cases which are doing heavy context
    startup and teardown at the same time as heavy interrupt load.
A fix to the generic code is being investigated also.
Signed-off-by: Michael Neuling mikey@neuling.org
    Cc: stable@vger.kernel.org # 3.8
    Tested-by: Andrew Donnellan andrew.donnellan@au1.ibm.com
    Acked-by: Ian Munsie imunsie@au1.ibm.com
    Tested-by: Vaibhav Jain vaibhav@linux.vnet.ibm.com
    Signed-off-by: Michael Ellerman mpe@ellerman.id.au
commit 9a11d2e7e66b6b8764a2430686b8716637bf812e
Author: Gustavo Padovan gustavo.padovan@collabora.co.uk
Date:   Thu Apr 14 10:58:54 2016 -0700
drm/virtio: send vblank event after crtc updates
virtio_gpu was failing to send vblank events when using the atomic IOCTL
    with the DRM_MODE_PAGE_FLIP_EVENT flag set. This patch fixes each and
    enables atomic pageflips updates.
Signed-off-by: Gustavo Padovan gustavo.padovan@collabora.co.uk
    Cc: stable@vger.kernel.org
    Signed-off-by: Dave Airlie airlied@redhat.com
commit 9dc0487d96a0396367a1451b31873482080b527f
Author: Lyude cpaul@redhat.com
Date:   Wed Apr 13 16:50:18 2016 -0400
drm/dp/mst: Restore primary hub guid on resume
Some hubs are forgetful, and end up forgetting whatever GUID we set
    previously after we do a suspend/resume cycle. This can lead to
    hotplugging breaking (along with probably other things) since the hub
    will start sending connection notifications with the wrong GUID. As
    such, we need to check on resume whether or not the GUID the hub is
    giving us is valid.
Signed-off-by: Lyude cpaul@redhat.com
    Reviewed-by: Harry Wentland harry.wentland@amd.com
    Signed-off-by: Daniel Vetter daniel.vetter@ffwll.ch
    Link: http://patchwork.freedesktop.org/patch/msgid/1460580618-7421-1-git-send-emai...
    Cc: stable@vger.kernel.org
    Signed-off-by: Dave Airlie airlied@redhat.com
commit 263efde31f97c498e1ebad30e4d2906609d7ad6b
Author: cpaul@redhat.com cpaul@redhat.com
Date:   Fri Apr 22 16:08:46 2016 -0400
drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()
We can thank KASAN for finding this, otherwise I probably would have spent
    hours on it. This fixes a somewhat harder to trigger kernel panic, occuring
    while enabling MST where the port we were currently updating the payload on
    would have all of it's refs dropped before we finished what we were doing:
==================================================================
    BUG: KASAN: use-after-free in drm_dp_update_payload_part1+0xb3f/0xdb0 [drm_kms_helper] at addr ffff8800d29de018
    Read of size 4 by task Xorg/973
    =============================================================================
    BUG kmalloc-2048 (Tainted: G    B   W      ): kasan: bad access detected
    -----------------------------------------------------------------------------
INFO: Allocated in drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper] age=16477 cpu=0 pid=2175
    	___slab_alloc+0x472/0x490
    	__slab_alloc+0x20/0x40
    	kmem_cache_alloc_trace+0x151/0x190
    	drm_dp_add_port+0x1aa/0x1ed0 [drm_kms_helper]
    	drm_dp_send_link_address+0x526/0x960 [drm_kms_helper]
    	drm_dp_check_and_send_link_address+0x1ac/0x210 [drm_kms_helper]
    	drm_dp_mst_link_probe_work+0x77/0xd0 [drm_kms_helper]
    	process_one_work+0x562/0x1350
    	worker_thread+0xd9/0x1390
    	kthread+0x1c5/0x260
    	ret_from_fork+0x22/0x40
    INFO: Freed in drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper] age=7521 cpu=0 pid=2175
    	__slab_free+0x17f/0x2d0
    	kfree+0x169/0x180
    	drm_dp_free_mst_port+0x50/0x60 [drm_kms_helper]
    	drm_dp_destroy_connector_work+0x2b8/0x490 [drm_kms_helper]
    	process_one_work+0x562/0x1350
    	worker_thread+0xd9/0x1390
    	kthread+0x1c5/0x260
    	ret_from_fork+0x22/0x40
which on this T460s, would eventually lead to kernel panics in somewhat
    random places later in intel_mst_enable_dp() if we got lucky enough.
Signed-off-by: Lyude cpaul@redhat.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Dave Airlie airlied@redhat.com
commit bd0b560a75bcebdcb48d82ed81f6b77c12771107
Merge: 02da2d7 2144fff
Author: Dave Airlie airlied@redhat.com
Date:   Wed Apr 27 09:19:06 2016 +1000
Merge branch 'drm-etnaviv-fixes' of git://git.pengutronix.de:/git/lst/linux into drm-fixes
just a single fix to not move the GPU linear window on cores where it
    might lead to inconsistent views of the memory by different engines in
    the core, thus breaking relocs and possibly causing other fun.
* 'drm-etnaviv-fixes' of git://git.pengutronix.de:/git/lst/linux:
      drm/etnaviv: don't move linear memory window on 3D cores without MC2.0
commit 8c0f55100478649e3c0133684aa4aebab77ce10f
Merge: 78cfca3 653aa46 33362c6
Author: Mark Brown broonie@kernel.org
Date:   Tue Apr 26 19:25:18 2016 +0100
Merge remote-tracking branches 'asoc/fix/rt5640' and 'asoc/fix/wm8962' into asoc-linus
commit 78cfca32cac26201d362fe9d2bf6f3c11a9f4a3b
Merge: e408057 ab9f87c dd5dc00 1b377cc e6cee90 af139d5
Author: Mark Brown broonie@kernel.org
Date:   Tue Apr 26 19:25:15 2016 +0100
Merge remote-tracking branches 'asoc/fix/arizona', 'asoc/fix/cs35l32', 'asoc/fix/hdac', 'asoc/fix/nau8825' and 'asoc/fix/rt5616' into asoc-linus
commit e408057767973e13d72bf52604957925720b7142
Merge: f179f3f8 f0c8e1d
Author: Mark Brown broonie@kernel.org
Date:   Tue Apr 26 19:25:14 2016 +0100
Merge remote-tracking branch 'asoc/fix/intel' into asoc-linus
commit f179f3f8a9bc86c43a1016c6d0ef87b7bb5ced86
Merge: 02da2d7 4732507
Author: Mark Brown broonie@kernel.org
Date:   Tue Apr 26 19:25:13 2016 +0100
Merge remote-tracking branch 'asoc/fix/dapm' into asoc-linus
commit e16d8a6cbb499c5c8bfe9330d3351b649bded4af
Author: Andy Lutomirski luto@kernel.org
Date:   Tue Apr 26 08:52:44 2016 -0700
Revert "x86/mm/32: Set NX in __supported_pte_mask before enabling paging"
This reverts commit 320d25b6a05f8b73c23fc21025d2906ecdd2d4fc.
This change was problematic for a couple of reasons:
1. It missed a some entry points (Xen things and 64-bit native).
2. The entry it changed can be executed more than once.  This isn't
       really a problem, but it conflated per-cpu state setup and global
       state setup.
3. It broke 64-bit non-NX.  64-bit non-NX worked the other way around from
       32-bit -- __supported_pte_mask had NX set initially and was *cleared*
       in x86_configure_nx.  With the patch applied, it never got cleared.
Reported-and-tested-by: Meelis Roos mroos@linux.ee
    Signed-off-by: Andy Lutomirski luto@kernel.org
    Cc: Andy Lutomirski luto@amacapital.net
    Cc: Borislav Petkov bp@alien8.de
    Cc: Brian Gerst brgerst@gmail.com
    Cc: Denys Vlasenko dvlasenk@redhat.com
    Cc: H. Peter Anvin hpa@zytor.com
    Cc: Linus Torvalds torvalds@linux-foundation.org
    Cc: Mike Galbraith efault@gmx.de
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Thomas Gleixner tglx@linutronix.de
    Link: http://lkml.kernel.org/r/59bd15f7f4b56b633a611b7f70876c6d2ad01a98.1461685884...
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit 32cc92c7b5e52357a0a24010bae9eb257fa75d3e
Author: Hariprasad S hariprasad@chelsio.com
Date:   Tue Apr 5 10:23:48 2016 +0530
RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips
For T4, kernel mode qps don't use the user doorbell. User mode qps during
    flow control db ringing are forced into kernel, where user doorbell is
    treated as kernel doorbell and proper bar2 offset in bar2 virtual space is
    calculated, which incase of T4 is a bogus address, causing a kernel panic
    due to illegal write during doorbell ringing.
    In case of T4, kernel mode qp bar2 virtual address should be 0. Added T4
    check during bar2 virtual address calculation to return 0. Fixed Bar2
    range checks based on bar2 physical address.
The below oops will be fixed
<1>BUG: unable to handle kernel paging request at 000000000002aa08
      <1>IP: [<ffffffffa011d800>] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4]
      <4>PGD 1416a8067 PUD 15bf35067 PMD 0
      <4>Oops: 0002 [#1] SMP
      <4>last sysfs file:
      /sys/devices/pci0000:00/0000:00:03.0/0000:02:00.4/infiniband/cxgb4_0/node_guid
      <4>CPU 5
      <4>Modules linked in: rdma_ucm rdma_cm ib_cm ib_sa ib_mad ib_uverbs
      ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE
      iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack
      ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables bridge autofs4
      target_core_iblock target_core_file target_core_pscsi target_core_mod
      configfs bnx2fc cnic uio fcoe libfcoe libfc scsi_transport_fc scsi_tgt 8021q
      garp stp llc cpufreq_ondemand acpi_cpufreq freq_table mperf vhost_net macvtap
      macvlan tun kvm uinput microcode iTCO_wdt iTCO_vendor_support sg joydev
      serio_raw i2c_i801 i2c_core lpc_ich mfd_core e1000e ptp pps_core ioatdma dca
      i7core_edac edac_core shpchp ext3 jbd mbcache sd_mod crc_t10dif pata_acpi
      ata_generic ata_piix iw_cxgb4 iw_cm ib_core ib_addr cxgb4 ipv6 dm_mirror
      dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
      <4>
      Supermicro X8ST3/X8ST3
      <4>RIP: 0010:[<ffffffffa011d800>]  [<ffffffffa011d800>]
      c4iw_uld_control+0x4e0/0x880 [iw_cxgb4]
      <4>RSP: 0000:ffff880155a03db0  EFLAGS: 00010006
      <4>RAX: 000000000000001d RBX: ffff88013ae5fc00 RCX: ffff880155adb180
      <4>RDX: 000000000002aa00 RSI: 0000000000000001 RDI: ffff88013ae5fdf8
      <4>RBP: ffff880155a03e10 R08: 0000000000000000 R09: 0000000000000001
      <4>R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
      <4>R13: 000000000000001d R14: ffff880156414ab0 R15: ffffe8ffffc05b88
      <4>FS:  0000000000000000(0000) GS:ffff8800282a0000(0000) knlGS:0000000000000000
      <4>CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
      <4>CR2: 000000000002aa08 CR3: 000000015bd0e000 CR4: 00000000000007e0
      <4>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      <4>DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
      <4>Process cxgb4 (pid: 394, threadinfo ffff880155a00000, task ffff880156414ab0)
      <4>Stack:
      <4> ffff880156415068 ffff880155adb180 ffff880155a03df0 ffffffffa00a344b
      <4><d> 00000000000003e8 ffff880155920000 0000000000000004 ffff880155920000
      <4><d> ffff88015592d438 ffffffffa00a3860 ffff880155a03fd8 ffffe8ffffc05b88
      <4>Call Trace:
      <4> [<ffffffffa00a344b>] ? enable_txq_db+0x2b/0x80 [cxgb4]
      <4> [<ffffffffa00a3860>] ? process_db_full+0x0/0xa0 [cxgb4]
      <4> [<ffffffffa00a38a6>] process_db_full+0x46/0xa0 [cxgb4]
      <4> [<ffffffff8109fda0>] worker_thread+0x170/0x2a0
      <4> [<ffffffff810a6aa0>] ? autoremove_wake_function+0x0/0x40
      <4> [<ffffffff8109fc30>] ? worker_thread+0x0/0x2a0
      <4> [<ffffffff810a660e>] kthread+0x9e/0xc0
      <4> [<ffffffff8100c28a>] child_rip+0xa/0x20
      <4> [<ffffffff810a6570>] ? kthread+0x0/0xc0
      <4> [<ffffffff8100c280>] ? child_rip+0x0/0x20
      <4>Code: e9 ba 00 00 00 66 0f 1f 44 00 00 44 8b 05 29 07 02 00 45 85 c0 0f 85
      71 02 00 00 8b 83 70 01 00 00 45 0f b7 ed c1 e0 0f 44 09 e8 <89> 42 08 0f ae f8
      66 c7 83 82 01 00 00 00 00 44 0f b7 ab dc 01
      <1>RIP  [<ffffffffa011d800>] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4]
      <4> RSP <ffff880155a03db0>
      <4>CR2: 000000000002aa08`
Based on original work by Bharat Potnuri bharat@chelsio.com
Fixes: 74217d4c6a4fb0d8 ("iw_cxgb4: support for bar2 qid densities exceeding the page size")
Signed-off-by: Steve Wise swise@opengridcomputing.com
    Signed-off-by: Hariprasad Shenai hariprasad@chelsio.com
    Reviewed-by: Leon Romanovsky leon@leon.nu
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 40edd7fdfc8a2c838c313b982f318cd69e638750
Author: Steve Wise swise@opengridcomputing.com
Date:   Tue Apr 12 06:55:03 2016 -0700
iw_cxgb4: handle draining an idle qp
In c4iw_drain_sq/rq(), if the particular queue is already empty
    then don't block.
Fixes: ce4af14d94aa ('iw_cxgb4: add queue drain functions')
    Signed-off-by: Steve Wise swise@opengridcomputing.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit ad202348fe3fa8187c43af5ab5b86fe6de057bd3
Author: Steve Wise swise@opengridcomputing.com
Date:   Tue Apr 12 06:55:01 2016 -0700
iw_cxgb3: initialize ibdev.iwcm->ifname for port mapping
The IWCM uses ibdev.iwcm->ifname for registration with the iwarp
    port map daemon.  But iw_cxgb3 did not initialize this field which
    causes intermittent registration failures based on the contents of the
    uninitialized memory.
Fixes: c1340e8aa628 ("iw_cxgb3: support for iWARP port mapping")
    Signed-off-by: Steve Wise swise@opengridcomputing.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 851d7b6b8a954b28f85e62a53cbba472907e21e4
Author: Steve Wise swise@opengridcomputing.com.com
Date:   Tue Apr 12 06:54:54 2016 -0700
iw_cxgb4: initialize ibdev.iwcm->ifname for port mapping
The IWCM uses ibdev.iwcm->ifname for registration with the iwarp
    port map daemon.  But iw_cxgb4 did not initialize this field which
    causes intermittent registration failures based on the contents of the
    uninitialized memory.
Fixes: 170003c894d9 ("iw_cxgb4: remove port mapper related code")
    Signed-off-by: Steve Wise swise@opengridcomputing.com
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 42235f80ab205bf5020cf33cb3e94455410abe36
Author: Sagi Grimberg sagi@grimberg.me
Date:   Tue Apr 26 17:55:38 2016 +0300
IB/core: Don't drain non-existent rq queue-pair
The drain_rq function expects a normal receive qp to drain.  A qp can
    only have either a normal rq or an srq.  If there is an srq, there
    is no rq to drain.  Until the API supports draining SRQs, simply
    skip draining the rq when the qp has an srq attached.
Fixes: 765d67748bcf ("IB: new common API for draining queues")
    Signed-off-by: Sagi Grimberg sagi@grimberg.me
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 346c09f80459a3ad97df1816d6d606169a51001a
Author: Roman Pen roman.penyaev@profitbricks.com
Date:   Tue Apr 26 13:15:35 2016 +0200
workqueue: fix ghost PENDING flag while doing MQ IO
The bug in a workqueue leads to a stalled IO request in MQ ctx->rq_list
    with the following backtrace:
[  601.347452] INFO: task kworker/u129:5:1636 blocked for more than 120 seconds.
    [  601.347574]       Tainted: G           O    4.4.5-1-storage+ #6
    [  601.347651] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    [  601.348142] kworker/u129:5  D ffff880803077988     0  1636      2 0x00000000
    [  601.348519] Workqueue: ibnbd_server_fileio_wq ibnbd_dev_file_submit_io_worker [ibnbd_server]
    [  601.348999]  ffff880803077988 ffff88080466b900 ffff8808033f9c80 ffff880803078000
    [  601.349662]  ffff880807c95000 7fffffffffffffff ffffffff815b0920 ffff880803077ad0
    [  601.350333]  ffff8808030779a0 ffffffff815b01d5 0000000000000000 ffff880803077a38
    [  601.350965] Call Trace:
    [  601.351203]  [<ffffffff815b0920>] ? bit_wait+0x60/0x60
    [  601.351444]  [<ffffffff815b01d5>] schedule+0x35/0x80
    [  601.351709]  [<ffffffff815b2dd2>] schedule_timeout+0x192/0x230
    [  601.351958]  [<ffffffff812d43f7>] ? blk_flush_plug_list+0xc7/0x220
    [  601.352208]  [<ffffffff810bd737>] ? ktime_get+0x37/0xa0
    [  601.352446]  [<ffffffff815b0920>] ? bit_wait+0x60/0x60
    [  601.352688]  [<ffffffff815af784>] io_schedule_timeout+0xa4/0x110
    [  601.352951]  [<ffffffff815b3a4e>] ? _raw_spin_unlock_irqrestore+0xe/0x10
    [  601.353196]  [<ffffffff815b093b>] bit_wait_io+0x1b/0x70
    [  601.353440]  [<ffffffff815b056d>] __wait_on_bit+0x5d/0x90
    [  601.353689]  [<ffffffff81127bd0>] wait_on_page_bit+0xc0/0xd0
    [  601.353958]  [<ffffffff81096db0>] ? autoremove_wake_function+0x40/0x40
    [  601.354200]  [<ffffffff81127cc4>] __filemap_fdatawait_range+0xe4/0x140
    [  601.354441]  [<ffffffff81127d34>] filemap_fdatawait_range+0x14/0x30
    [  601.354688]  [<ffffffff81129a9f>] filemap_write_and_wait_range+0x3f/0x70
    [  601.354932]  [<ffffffff811ced3b>] blkdev_fsync+0x1b/0x50
    [  601.355193]  [<ffffffff811c82d9>] vfs_fsync_range+0x49/0xa0
    [  601.355432]  [<ffffffff811cf45a>] blkdev_write_iter+0xca/0x100
    [  601.355679]  [<ffffffff81197b1a>] __vfs_write+0xaa/0xe0
    [  601.355925]  [<ffffffff81198379>] vfs_write+0xa9/0x1a0
    [  601.356164]  [<ffffffff811c59d8>] kernel_write+0x38/0x50
The underlying device is a null_blk, with default parameters:
queue_mode    = MQ
      submit_queues = 1
Verification that nullb0 has something inflight:
root@pserver8:~# cat /sys/block/nullb0/inflight
           0        1
    root@pserver8:~# find /sys/block/nullb0/mq/0/cpu* -name rq_list -print -exec cat {} ;
    ...
    /sys/block/nullb0/mq/0/cpu2/rq_list
    CTX pending:
            ffff8838038e2400
    ...
During debug it became clear that stalled request is always inserted in
    the rq_list from the following path:
save_stack_trace_tsk + 34
       blk_mq_insert_requests + 231
       blk_mq_flush_plug_list + 281
       blk_flush_plug_list + 199
       wait_on_page_bit + 192
       __filemap_fdatawait_range + 228
       filemap_fdatawait_range + 20
       filemap_write_and_wait_range + 63
       blkdev_fsync + 27
       vfs_fsync_range + 73
       blkdev_write_iter + 202
       __vfs_write + 170
       vfs_write + 169
       kernel_write + 56
So blk_flush_plug_list() was called with from_schedule == true.
If from_schedule is true, that means that finally blk_mq_insert_requests()
    offloads execution of __blk_mq_run_hw_queue() and uses kblockd workqueue,
    i.e. it calls kblockd_schedule_delayed_work_on().
That means, that we race with another CPU, which is about to execute
    __blk_mq_run_hw_queue() work.
Further debugging shows the following traces from different CPUs:
CPU#0                                  CPU#1
      ----------------------------------     -------------------------------
      reqeust A inserted
      STORE hctx->ctx_map[0] bit marked
      kblockd_schedule...() returns 1
      <schedule to kblockd workqueue>
                                             request B inserted
                                             STORE hctx->ctx_map[1] bit marked
                                             kblockd_schedule...() returns 0
      *** WORK PENDING bit is cleared ***
      flush_busy_ctxs() is executed, but
      bit 1, set by CPU#1, is not observed
As a result request B pended forever.
This behaviour can be explained by speculative LOAD of hctx->ctx_map on
    CPU#0, which is reordered with clear of PENDING bit and executed _before_
    actual STORE of bit 1 on CPU#1.
The proper fix is an explicit full barrier <mfence>, which guarantees
    that clear of PENDING bit is to be executed before all possible
    speculative LOADS or STORES inside actual work function.
Signed-off-by: Roman Pen roman.penyaev@profitbricks.com
    Cc: Gioh Kim gi-oh.kim@profitbricks.com
    Cc: Michael Wang yun.wang@profitbricks.com
    Cc: Tejun Heo tj@kernel.org
    Cc: Jens Axboe axboe@kernel.dk
    Cc: linux-block@vger.kernel.org
    Cc: linux-kernel@vger.kernel.org
    Cc: stable@vger.kernel.org
    Signed-off-by: Tejun Heo tj@kernel.org
commit bb03ed216370cb021f377f923471e56d1de3ff5d
Author: Takashi Iwai tiwai@suse.de
Date:   Thu Apr 21 16:39:17 2016 +0200
ALSA: hda - Update BCLK also at hotplug for i915 HSW/BDW
The recent bug report suggests that BCLK setup for i915 HSW/BDW needs
    to be updated at each HDMI hotplug, not only at initialization and
    resume.  That is, we need to update HSW_EM4 and HSW_EM5 registers at
    ELD notification, too.  Otherwise the HDMI audio may be out of sync
    and played in a wrong pitch.
However, the HDA codec driver has no access to the controller
    registers, and currently the code managing these registers is in
    hda_intel.c, i.e. local to the controller driver.  For allowing the
    explicit BCLK update from the codec driver, as in this patch, the
    former haswell_set_bclk() in hda_intel.c is moved to hdac_i915.c and
    exposed as snd_hdac_i915_set_bclk().  This is called from both the HDA
    controller driver and intel_pin_eld_notify() in HDMI codec driver.
Along with this change, snd_hdac_get_display_clk() gets dropped as
    it's no longer used.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91410
    Cc: stable@vger.kernel.org # v4.5+
    Signed-off-by: Takashi Iwai tiwai@suse.de
commit 037e119738120c1cdc460c6ae33871c3000531f3
Author: Conrad Kostecki ck+linuxkernel@bl4ckb0x.de
Date:   Tue Apr 26 10:08:10 2016 +0200
ALSA: hda - Add dock support for ThinkPad X260
Fixes audio output on a ThinkPad X260, when using Lenovo CES 2013
    docking station series (basic, pro, ultra).
Signed-off-by: Conrad Kostecki ck+linuxkernel@bl4ckb0x.de
    Cc: stable@vger.kernel.org
    Signed-off-by: Takashi Iwai tiwai@suse.de
commit 1becf03545a0859ceaaf9e8c2d9861882a71cb01
Author: Srinivas Pandruvada srinivas.pandruvada@linux.intel.com
Date:   Fri Apr 22 19:53:59 2016 -0700
cpufreq: intel_pstate: Fix processing for turbo activation ratio
When the config TDP level is not nominal (level = 0), the MSR values for
    reading level 1 and level 2 ratios contain power in low 14 bits and actual
    ratio bits are at bits [23:16]. The current processing for level 1 and
    level 2 is wrong as there is no shift done to get actual ratio.
Fixes: 6a35fc2d6c22 (cpufreq: intel_pstate: get P1 from TAR when available)
    Signed-off-by: Srinivas Pandruvada srinivas.pandruvada@linux.intel.com
    Cc: 4.4+ stable@vger.kernel.org # 4.4+
    Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com
commit 264a0ae164bc0e9144bebcd25ff030d067b1a878
Author: Tejun Heo tj@kernel.org
Date:   Thu Apr 21 19:09:02 2016 -0400
memcg: relocate charge moving from ->attach to ->post_attach
Hello,
So, this ended up a lot simpler than I originally expected.  I tested
    it lightly and it seems to work fine.  Petr, can you please test these
    two patches w/o the lru drain drop patch and see whether the problem
    is gone?
Thanks.
    ------ 8< ------
    If charge moving is used, memcg performs relabeling of the affected
    pages from its ->attach callback which is called under both
    cgroup_threadgroup_rwsem and thus can't create new kthreads.  This is
    fragile as various operations may depend on workqueues making forward
    progress which relies on the ability to create new kthreads.
There's no reason to perform charge moving from ->attach which is deep
    in the task migration path.  Move it to ->post_attach which is called
    after the actual migration is finished and cgroup_threadgroup_rwsem is
    dropped.
* move_charge_struct->mm is added and ->can_attach is now responsible
      for pinning and recording the target mm.  mem_cgroup_clear_mc() is
      updated accordingly.  This also simplifies mem_cgroup_move_task().
* mem_cgroup_move_task() is now called from ->post_attach instead of
      ->attach.
Signed-off-by: Tejun Heo tj@kernel.org
    Cc: Johannes Weiner hannes@cmpxchg.org
    Acked-by: Michal Hocko mhocko@kernel.org
    Debugged-and-tested-by: Petr Mladek pmladek@suse.com
    Reported-by: Cyril Hrubis chrubis@suse.cz
    Reported-by: Johannes Weiner hannes@cmpxchg.org
    Fixes: 1ed1328792ff ("sched, cgroup: replace signal_struct->group_rwsem with a global percpu_rwsem")
    Cc: stable@vger.kernel.org # 4.4+
commit 5cf1cacb49aee39c3e02ae87068fc3c6430659b0
Author: Tejun Heo tj@kernel.org
Date:   Thu Apr 21 19:06:48 2016 -0400
cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback
Since e93ad19d0564 ("cpuset: make mm migration asynchronous"), cpuset
    kicks off asynchronous NUMA node migration if necessary during task
    migration and flushes it from cpuset_post_attach_flush() which is
    called at the end of __cgroup_procs_write().  This is to avoid
    performing migration with cgroup_threadgroup_rwsem write-locked which
    can lead to deadlock through dependency on kworker creation.
memcg has a similar issue with charge moving, so let's convert it to
    an official callback rather than the current one-off cpuset specific
    function.  This patch adds cgroup_subsys->post_attach callback and
    makes cpuset register cpuset_post_attach_flush() as its ->post_attach.
The conversion is mostly one-to-one except that the new callback is
    called under cgroup_mutex.  This is to guarantee that no other
    migration operations are started before ->post_attach callbacks are
    finished.  cgroup_mutex is one of the outermost mutex in the system
    and has never been and shouldn't be a problem.  We can add specialized
    synchronization around __cgroup_procs_write() but I don't think
    there's any noticeable benefit.
Signed-off-by: Tejun Heo tj@kernel.org
    Cc: Li Zefan lizefan@huawei.com
    Cc: Johannes Weiner hannes@cmpxchg.org
    Cc: Michal Hocko mhocko@kernel.org
    Cc: stable@vger.kernel.org # 4.4+ prerequisite for the next patch
commit 6c1ea260f89709e0021d2c59f8fd2a104b5b1123
Author: Ilya Dryomov idryomov@gmail.com
Date:   Mon Apr 11 19:34:49 2016 +0200
libceph: make authorizer destruction independent of ceph_auth_client
Starting the kernel client with cephx disabled and then enabling cephx
    and restarting userspace daemons can result in a crash:
[262671.478162] BUG: unable to handle kernel paging request at ffffebe000000000
        [262671.531460] IP: [<ffffffff811cd04a>] kfree+0x5a/0x130
        [262671.584334] PGD 0
        [262671.635847] Oops: 0000 [#1] SMP
        [262672.055841] CPU: 22 PID: 2961272 Comm: kworker/22:2 Not tainted 4.2.0-34-generic #39~14.04.1-Ubuntu
        [262672.162338] Hardware name: Dell Inc. PowerEdge R720/068CDY, BIOS 2.4.3 07/09/2014
        [262672.268937] Workqueue: ceph-msgr con_work [libceph]
        [262672.322290] task: ffff88081c2d0dc0 ti: ffff880149ae8000 task.ti: ffff880149ae8000
        [262672.428330] RIP: 0010:[<ffffffff811cd04a>]  [<ffffffff811cd04a>] kfree+0x5a/0x130
        [262672.535880] RSP: 0018:ffff880149aeba58  EFLAGS: 00010286
        [262672.589486] RAX: 000001e000000000 RBX: 0000000000000012 RCX: ffff8807e7461018
        [262672.695980] RDX: 000077ff80000000 RSI: ffff88081af2be04 RDI: 0000000000000012
        [262672.803668] RBP: ffff880149aeba78 R08: 0000000000000000 R09: 0000000000000000
        [262672.912299] R10: ffffebe000000000 R11: ffff880819a60e78 R12: ffff8800aec8df40
        [262673.021769] R13: ffffffffc035f70f R14: ffff8807e5b138e0 R15: ffff880da9785840
        [262673.131722] FS:  0000000000000000(0000) GS:ffff88081fac0000(0000) knlGS:0000000000000000
        [262673.245377] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        [262673.303281] CR2: ffffebe000000000 CR3: 0000000001c0d000 CR4: 00000000001406e0
        [262673.417556] Stack:
        [262673.472943]  ffff880149aeba88 ffff88081af2be04 ffff8800aec8df40 ffff88081af2be04
        [262673.583767]  ffff880149aeba98 ffffffffc035f70f ffff880149aebac8 ffff8800aec8df00
        [262673.694546]  ffff880149aebac8 ffffffffc035c89e ffff8807e5b138e0 ffff8805b047f800
        [262673.805230] Call Trace:
        [262673.859116]  [<ffffffffc035f70f>] ceph_x_destroy_authorizer+0x1f/0x50 [libceph]
        [262673.968705]  [<ffffffffc035c89e>] ceph_auth_destroy_authorizer+0x3e/0x60 [libceph]
        [262674.078852]  [<ffffffffc0352805>] put_osd+0x45/0x80 [libceph]
        [262674.134249]  [<ffffffffc035290e>] remove_osd+0xae/0x140 [libceph]
        [262674.189124]  [<ffffffffc0352aa3>] __reset_osd+0x103/0x150 [libceph]
        [262674.243749]  [<ffffffffc0354703>] kick_requests+0x223/0x460 [libceph]
        [262674.297485]  [<ffffffffc03559e2>] ceph_osdc_handle_map+0x282/0x5e0 [libceph]
        [262674.350813]  [<ffffffffc035022e>] dispatch+0x4e/0x720 [libceph]
        [262674.403312]  [<ffffffffc034bd91>] try_read+0x3d1/0x1090 [libceph]
        [262674.454712]  [<ffffffff810ab7c2>] ? dequeue_entity+0x152/0x690
        [262674.505096]  [<ffffffffc034cb1b>] con_work+0xcb/0x1300 [libceph]
        [262674.555104]  [<ffffffff8108fb3e>] process_one_work+0x14e/0x3d0
        [262674.604072]  [<ffffffff810901ea>] worker_thread+0x11a/0x470
        [262674.652187]  [<ffffffff810900d0>] ? rescuer_thread+0x310/0x310
        [262674.699022]  [<ffffffff810957a2>] kthread+0xd2/0xf0
        [262674.744494]  [<ffffffff810956d0>] ? kthread_create_on_node+0x1c0/0x1c0
        [262674.789543]  [<ffffffff817bd81f>] ret_from_fork+0x3f/0x70
        [262674.834094]  [<ffffffff810956d0>] ? kthread_create_on_node+0x1c0/0x1c0
What happens is the following:
(1) new MON session is established
        (2) old "none" ac is destroyed
        (3) new "cephx" ac is constructed
        ...
        (4) old OSD session (w/ "none" authorizer) is put
              ceph_auth_destroy_authorizer(ac, osd->o_auth.authorizer)
osd->o_auth.authorizer in the "none" case is just a bare pointer into
    ac, which contains a single static copy for all services.  By the time
    we get to (4), "none" ac, freed in (2), is long gone.  On top of that,
    a new vtable installed in (3) points us at ceph_x_destroy_authorizer(),
    so we end up trying to destroy a "none" authorizer with a "cephx"
    destructor operating on invalid memory!
To fix this, decouple authorizer destruction from ac and do away with
    a single static "none" authorizer by making a copy for each OSD or MDS
    session.  Authorizers themselves are independent of ac and so there is
    no reason for destroy_authorizer() to be an ac op.  Make it an op on
    the authorizer itself by turning ceph_authorizer into a real struct.
Fixes: http://tracker.ceph.com/issues/15447
Reported-by: Alan Zhang alan.zhang@linux.com
    Signed-off-by: Ilya Dryomov idryomov@gmail.com
    Reviewed-by: Sage Weil sage@redhat.com
commit a30b8f81d9d6fe24eab8a023794548b048f08e3c
Author: Azael Avalos coproscefalo@gmail.com
Date:   Fri Apr 22 09:29:36 2016 -0600
toshiba_acpi: Fix regression caused by hotkey enabling value
Commit 52cbae0127ad ("toshiba_acpi: Change default Hotkey enabling value")
    changed the hotkeys enabling value, as it was the same value Windows uses,
    however, it turns out that the value tells the EC that the driver will now
    take care of the hardware events like the physical RFKill switch or the
    pointing device toggle button.
This patch reverts such commit by changing the default hotkey enabling
    value to 0x09, which enables hotkey events only, making the hardware
    buttons working again.
Fixes bugs 113331 and 114941.
Signed-off-by: Azael Avalos coproscefalo@gmail.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Darren Hart dvhart@linux.intel.com
commit ede85e90be26e5de2a72f76feec01cfc5281d4bd
Merge: 02da2d7 630ba0c
Author: Ingo Molnar mingo@kernel.org
Date:   Mon Apr 25 17:28:11 2016 +0200
Merge tag 'efi-urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/mfleming/efi into efi/urgent
Pull EFI fix from Matt Fleming:
* Avoid out-of-bounds access in the efivars code when performing
       string matching on converted EFI variable names (Laszlo Ersek)
Signed-off-by: Ingo Molnar mingo@kernel.org
commit 89a095668304e8a02502ffd35edacffdbf49aa8c
Author: Ricardo Ribalda ricardo.ribalda@gmail.com
Date:   Thu Mar 3 16:12:48 2016 -0300
[media] vb2-memops: Fix over allocation of frame vectors
On page unaligned frames, create_framevec forces get_vaddr_frames to
    allocate an extra page at the end of the buffer. Under some
    circumstances, this leads to -EINVAL on VIDIOC_QBUF.
E.g:
    We have vm_a that vm_area that goes from 0x1000 to 0x3000. And a
    frame that goes from 0x1800 to 0x2800, i.e. 2 pages.
frame_vector_create will be called with the following params:
get_vaddr_frames(0x1800, 2, write, 1, vec);
get_vaddr will allocate the first page after checking that the memory
    0x1800-0x27ff is valid, but it will not allocate the second page because
    the range 0x2800-0x37ff is out of the vm_a range. This results in
    create_framevec returning -EFAULT
Error Trace:
    [ 9083.793015] video0: VIDIOC_QBUF: 00:00:00.00000000 index=1,
    type=vid-cap, flags=0x00002002, field=any, sequence=0,
    memory=userptr, bytesused=0, offset/userptr=0x7ff2b023ca80, length=5765760
    [ 9083.793028] timecode=00:00:00 type=0, flags=0x00000000,
    frames=0, userbits=0x00000000
    [ 9083.793117] video0: VIDIOC_QBUF: error -22: 00:00:00.00000000
    index=2, type=vid-cap, flags=0x00000000, field=any, sequence=0,
    memory=userptr, bytesused=0, offset/userptr=0x7ff2b07bc500, length=5765760
Also use true instead of 1 since that argument is a bool in the
    get_vaddr_frames() prototype.
Fixes: 21fb0cb7ec65 ("[media] vb2: Provide helpers for mapping virtual addresses")
Reported-by: Albert Antony albert@newtec.dk
    Signed-off-by: Ricardo Ribalda Delgado ricardo.ribalda@gmail.com
    [hans.verkuil@cisco.com: merged the 'bool' change into this patch]
    Acked-by: Marek Szyprowski m.szyprowski@samsung.com
    Reviewed-by: Jan Kara jack@suse.cz
    Cc: stable@vger.kernel.org      # for v4.3 and up
    Signed-off-by: Hans Verkuil hans.verkuil@cisco.com
Signed-off-by: Mauro Carvalho Chehab mchehab@osg.samsung.com
commit b93876845c5e30a92964eeb088d9d2e024118022
Author: Ricardo Ribalda ricardo.ribalda@gmail.com
Date:   Mon Apr 25 06:04:45 2016 -0300
[media] media: vb2: Fix regression on poll() for RW mode
When using a device is read/write mode, vb2 does not handle properly the
    first select/poll operation.
The reason for this, is that when this code has been refactored, some of
    the operations have changed their order, and now fileio emulator is not
    started.
The reintroduced check to the core is enabled by a quirk flag, that
    avoids this check by other subsystems like DVB.
Fixes: 49d8ab9feaf2 ("media] media: videobuf2: Separate vb2_poll()")
Reported-by: Dimitrios Katsaros patcherwork@gmail.com
    Cc: Junghak Sung jh1009.sung@samsung.com
    Cc: stable@vger.kernel.org      # for v4.5 and up
    Signed-off-by: Ricardo Ribalda Delgado ricardo.ribalda@gmail.com
    Signed-off-by: Hans Verkuil hans.verkuil@cisco.com
    Signed-off-by: Mauro Carvalho Chehab mchehab@osg.samsung.com
commit 3020ca711871fdaf0c15c8bab677a6bc302e28fe
Author: Hans Verkuil hverkuil@xs4all.nl
Date:   Fri Apr 22 04:00:50 2016 -0300
[media] v4l2-dv-timings.h: fix polarity for 4k formats
The VSync polarity was negative instead of positive for the 4k CEA formats.
    I probably copy-and-pasted these from the DMT 4k format, which does have a
    negative VSync polarity.
Signed-off-by: Hans Verkuil hans.verkuil@cisco.com
    Reported-by: Martin Bugge marbugge@cisco.com
    Cc: stable@vger.kernel.org      # for v4.1 and up
    Signed-off-by: Mauro Carvalho Chehab mchehab@osg.samsung.com
commit c26f6c61578852f679787d555e6d07804e1f5f14
Author: Andrew Gabbasov andrew_gabbasov@mentor.com
Date:   Mon Apr 25 06:19:38 2016 -0500
udf: Fix conversion of 'dstring' fields to UTF8
Commit 9293fcfbc1812a22ad5ce1b542eb90c1bbe01be1
    ("udf: Remove struct ustr as non-needed intermediate storage"),
    while getting rid of 'struct ustr', does not take any special care
    of 'dstring' fields and effectively use fixed field length instead
    of actual string length, encoded in the last byte of the field.
Also, commit 484a10f49387e4386bf2708532e75bf78ffea2cb
    ("udf: Merge linux specific translation into CS0 conversion function")
    introduced checking of the length of the string being converted,
    requiring proper alignment to number of bytes constituing each
    character.
The UDF volume identifier is represented as a 32-bytes 'dstring',
    and needs to be converted from CS0 to UTF8, while mounting UDF
    filesystem. The changes in mentioned commits can in some cases
    lead to incorrect handling of volume identifier:
    - if the actual string in 'dstring' is of maximal length and
    does not have zero bytes separating it from dstring encoded
    length in last byte, that last byte may be included in conversion,
    thus making incorrect resulting string;
    - if the identifier is encoded with 2-bytes characters (compression
    code is 16), the length of 31 bytes (32 bytes of field length minus
    1 byte of compression code), taken as the string length, is reported
    as an incorrect (unaligned) length, and the conversion fails, which
    in its turn leads to volume mounting failure.
This patch introduces handling of 'dstring' encoded length field
    in udf_CS0toUTF8 function, that is used in all and only cases
    when 'dstring' fields are converted. Currently these cases are
    processing of Volume Identifier and Volume Set Identifier fields.
    The function is also renamed to udf_dstrCS0toUTF8 to distinctly
    indicate that it handles 'dstring' input.
Signed-off-by: Andrew Gabbasov andrew_gabbasov@mentor.com
    Signed-off-by: Jan Kara jack@suse.cz
commit da67e68c0e4601e87612918496fd8c7d72795e50
Author: Eric Engestrom eric@engestrom.ch
Date:   Mon Apr 25 01:24:04 2016 +0100
Documentation: dt: arc: fix spelling mistakes
Signed-off-by: Eric Engestrom eric@engestrom.ch
    Signed-off-by: Vineet Gupta vgupta@synopsys.com
commit 94862a62dfe3ba1c7601115a2dc80721c5b256f0
Author: Rafael J. Wysocki rafael.j.wysocki@intel.com
Date:   Thu Apr 21 20:57:47 2016 +0200
Revert "cpufreq: governor: Fix negative idle_time when configured with CONFIG_HZ_PERIODIC"
Revert commit 0df35026c6a5 (cpufreq: governor: Fix negative idle_time
    when configured with CONFIG_HZ_PERIODIC) that introduced a regression
    by causing the ondemand cpufreq governor to misbehave for
    CONFIG_TICK_CPU_ACCOUNTING unset (the frequency goes up to the max at
    one point and stays there indefinitely).
The revert takes subsequent modifications of the code in question into
    account.
Fixes: 0df35026c6a5 (cpufreq: governor: Fix negative idle_time when configured with CONFIG_HZ_PERIODIC)
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=115261
    Reported-and-tested-by: Timo Valtoaho timo.valtoaho@gmail.com
    Cc: 4.5+ stable@vger.kernel.org # 4.5+
    Signed-off-by: Rafael J. Wysocki rafael.j.wysocki@intel.com
    Acked-by: Viresh Kumar viresh.kumar@linaro.org
commit 75dd602a5198a6e5f75534db52b6e6fbaabb33d1
Author: Peter Zijlstra peterz@infradead.org
Date:   Wed Mar 30 11:36:59 2016 +0200
lockdep: Fix lock_chain::base size
lock_chain::base is used to store an index into the chain_hlocks[]
    array, however that array contains more elements than can be indexed
    using the u16.
Change the lock_chain structure to use a bitfield to encode the data
    it needs and add BUILD_BUG_ON() assertions to check the fields are
    wide enough.
Also, for DEBUG_LOCKDEP, assert that we don't run out of elements of
    that array; as that would wreck the collision detectoring.
Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org
    Cc: Alfredo Alvarez Fernandez alfredoalvarezfernandez@gmail.com
    Cc: Andrew Morton akpm@linux-foundation.org
    Cc: Linus Torvalds torvalds@linux-foundation.org
    Cc: Paul E. McKenney paulmck@linux.vnet.ibm.com
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Sedat Dilek sedat.dilek@gmail.com
    Cc: Theodore Ts'o tytso@mit.edu
    Cc: Thomas Gleixner tglx@linutronix.de
    Link: http://lkml.kernel.org/r/20160330093659.GS3408@twins.programming.kicks-ass.n...
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit c24697566298df04cac9913e0601501b5ee2b3f5
Author: Boqun Feng boqun.feng@gmail.com
Date:   Tue Feb 16 13:57:40 2016 +0800
locking/lockdep: Fix ->irq_context calculation
task_irq_context() returns the encoded irq_context of the task, the
    return value is encoded in the same as ->irq_context of held_lock.
Always return 0 if !(CONFIG_TRACE_IRQFLAGS && CONFIG_PROVE_LOCKING)
Signed-off-by: Boqun Feng boqun.feng@gmail.com
    Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org
    Cc: Andrew Morton akpm@linux-foundation.org
    Cc: Josh Triplett josh@joshtriplett.org
    Cc: Lai Jiangshan jiangshanlai@gmail.com
    Cc: Linus Torvalds torvalds@linux-foundation.org
    Cc: Mathieu Desnoyers mathieu.desnoyers@efficios.com
    Cc: Paul E. McKenney paulmck@linux.vnet.ibm.com
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Steven Rostedt rostedt@goodmis.org
    Cc: Thomas Gleixner tglx@linutronix.de
    Cc: sasha.levin@oracle.com
    Link: http://lkml.kernel.org/r/1455602265-16490-2-git-send-email-boqun.feng@gmail....
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit b303e7c15d53cd8ef6b349b702e07eee3f102792
Author: Peter Zijlstra peterz@infradead.org
Date:   Mon Apr 4 09:57:40 2016 +0200
perf/core: Make sysctl_perf_cpu_time_max_percent conform to documentation
Markus reported that 0 should also disable the throttling we per
    Documentation/sysctl/kernel.txt.
Reported-by: Markus Trippelsdorf markus@trippelsdorf.de
    Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org
    Cc: Alexander Shishkin alexander.shishkin@linux.intel.com
    Cc: Arnaldo Carvalho de Melo acme@redhat.com
    Cc: Jiri Olsa jolsa@redhat.com
    Cc: Linus Torvalds torvalds@linux-foundation.org
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Stephane Eranian eranian@google.com
    Cc: Thomas Gleixner tglx@linutronix.de
    Cc: Vince Weaver vincent.weaver@maine.edu
    Fixes: 91a612eea9a3 ("perf/core: Fix dynamic interrupt throttle")
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit e1089602a3bf3efd13d0ffc575f3e22213f009da
Author: Srinivas Pandruvada srinivas.pandruvada@linux.intel.com
Date:   Sun Apr 17 08:43:29 2016 -0700
perf/x86/intel/rapl: Add missing Haswell model
Added one missing Haswell model.
Signed-off-by: Srinivas Pandruvada srinivas.pandruvada@linux.intel.com
    Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org
    Cc: Alexander Shishkin alexander.shishkin@linux.intel.com
    Cc: Arnaldo Carvalho de Melo acme@redhat.com
    Cc: Jiri Olsa jolsa@redhat.com
    Cc: Linus Torvalds torvalds@linux-foundation.org
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Stephane Eranian eranian@google.com
    Cc: Thomas Gleixner tglx@linutronix.de
    Cc: Vince Weaver vincent.weaver@maine.edu
    Cc: bp@alien8.de
    Cc: hpa@zytor.com
    Link: http://lkml.kernel.org/r/1460907809-11897-1-git-send-email-srinivas.pandruva...
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit b89c173788c3a8ed571652c203bf59a0e9d700aa
Author: Andi Kleen ak@linux.intel.com
Date:   Fri Apr 15 13:25:33 2016 -0700
perf/x86/intel: Add model number for Skylake Server to perf
Everything the same as base Skylake, just a new model number.
Signed-off-by: Andi Kleen ak@linux.intel.com
    Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org
    Cc: Alexander Shishkin alexander.shishkin@linux.intel.com
    Cc: Arnaldo Carvalho de Melo acme@redhat.com
    Cc: Jiri Olsa jolsa@redhat.com
    Cc: Linus Torvalds torvalds@linux-foundation.org
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Stephane Eranian eranian@google.com
    Cc: Thomas Gleixner tglx@linutronix.de
    Cc: Vince Weaver vincent.weaver@maine.edu
    Link: http://lkml.kernel.org/r/1460751933-2264-1-git-send-email-andi@firstfloor.or...
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit 707e59ba494372a90d245f18b0c78982caa88e48
Author: Ross Lagerwall ross.lagerwall@citrix.com
Date:   Fri Apr 22 13:05:31 2016 +0100
xen/qspinlock: Don't kick CPU if IRQ is not initialized
The following commit:
1fb3a8b2cfb2 ("xen/spinlock: Fix locking path engaging too soon under PVHVM.")
... moved the initalization of the kicker interrupt until after
    native_cpu_up() is called.
However, when using qspinlocks, a CPU may try to kick another CPU that is
    spinning (because it has not yet initialized its kicker interrupt), resulting
    in the following crash during boot:
kernel BUG at /build/linux-Ay7j_C/linux-4.4.0/drivers/xen/events/events_base.c:1210!
      invalid opcode: 0000 [#1] SMP
      ...
      RIP: 0010:[<ffffffff814c97c9>]  [<ffffffff814c97c9>] xen_send_IPI_one+0x59/0x60
      ...
      Call Trace:
       [<ffffffff8102be9e>] xen_qlock_kick+0xe/0x10
       [<ffffffff810cabc2>] __pv_queued_spin_unlock+0xb2/0xf0
       [<ffffffff810ca6d1>] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
       [<ffffffff81052936>] ? check_tsc_warp+0x76/0x150
       [<ffffffff81052aa6>] check_tsc_sync_source+0x96/0x160
       [<ffffffff81051e28>] native_cpu_up+0x3d8/0x9f0
       [<ffffffff8102b315>] xen_hvm_cpu_up+0x35/0x80
       [<ffffffff8108198c>] _cpu_up+0x13c/0x180
       [<ffffffff81081a4a>] cpu_up+0x7a/0xa0
       [<ffffffff81f80dfc>] smp_init+0x7f/0x81
       [<ffffffff81f5a121>] kernel_init_freeable+0xef/0x212
       [<ffffffff81817f30>] ? rest_init+0x80/0x80
       [<ffffffff81817f3e>] kernel_init+0xe/0xe0
       [<ffffffff8182488f>] ret_from_fork+0x3f/0x70
       [<ffffffff81817f30>] ? rest_init+0x80/0x80
To fix this, only send the kick if the target CPU's interrupt has been
    initialized. This check isn't racy, because the target is waiting for
    the spinlock, so it won't have initialized the interrupt in the
    meantime.
Signed-off-by: Ross Lagerwall ross.lagerwall@citrix.com
    Reviewed-by: Boris Ostrovsky boris.ostrovsky@oracle.com
    Cc: David Vrabel david.vrabel@citrix.com
    Cc: Juergen Gross jgross@suse.com
    Cc: Konrad Rzeszutek Wilk konrad.wilk@oracle.com
    Cc: Linus Torvalds torvalds@linux-foundation.org
    Cc: Peter Zijlstra peterz@infradead.org
    Cc: Thomas Gleixner tglx@linutronix.de
    Cc: linux-kernel@vger.kernel.org
    Cc: xen-devel@lists.xenproject.org
    Signed-off-by: Ingo Molnar mingo@kernel.org
commit f4e7de63ab273b6a5e35c82eb4fc6363c855ddd4
Author: Doug Ledford dledford@redhat.com
Date:   Fri Apr 22 20:14:58 2016 -0400
IB/core: Fix oops in ib_cache_gid_set_default_gid
When we fail to find the default gid index, we can't continue
    processing in this routine or else we will pass a negative
    index to later routines resulting in invalid memory access
    attempts and a kernel oops.
Fixes: 03db3a2d81e6 (IB/core: Add RoCE GID table management)
    Signed-off-by: Doug Ledford dledford@redhat.com
commit 630ba0cc7a6dbafbdee43795617c872b35cde1b4
Author: Laszlo Ersek lersek@redhat.com
Date:   Thu Apr 21 18:21:11 2016 +0200
efi: Fix out-of-bounds read in variable_matches()
The variable_matches() function can currently read "var_name[len]", for
    example when:
- var_name[0] == 'a',
     - len == 1
     - match_name points to the NUL-terminated string "ab".
This function is supposed to accept "var_name" inputs that are not
    NUL-terminated (hence the "len" parameter"). Document the function, and
    access "var_name[*match]" only if "*match" is smaller than "len".
Reported-by: Chris Wilson chris@chris-wilson.co.uk
    Signed-off-by: Laszlo Ersek lersek@redhat.com
    Cc: Peter Jones pjones@redhat.com
    Cc: Matthew Garrett mjg59@coreos.com
    Cc: Jason Andryuk jandryuk@gmail.com
    Cc: Jani Nikula jani.nikula@linux.intel.com
    Cc: stable@vger.kernel.org # v3.10+
    Link: http://thread.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/86906
    Signed-off-by: Matt Fleming matt@codeblueprint.co.uk
commit 10ff4c5239a137abfc896ec73ef3d15a0f86a16a
Author: Javier Martinez Canillas javier@osg.samsung.com
Date:   Sat Apr 16 21:14:52 2016 -0400
i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared
The exynos5 I2C controller driver always prepares and enables a clock
    before using it and then disables unprepares it when the clock is not
    used anymore.
But this can cause a possible ABBA deadlock in some scenarios since a
    driver that uses regmap to access its I2C registers, will first grab
    the regmap lock and then the I2C xfer function will grab the prepare
    lock when preparing the I2C clock. But since the clock driver also
    uses regmap for I2C accesses, preparing a clock will first grab the
    prepare lock and then the regmap lock when using the regmap API.
An example of this happens on the Exynos5422 Odroid XU4 board where a
    s2mps11 PMIC is used and both the s2mps11 regulators and clk drivers
    share the same I2C regmap.
The possible deadlock is reported by the kernel lockdep:
Possible unsafe locking scenario:
CPU0                    CPU1
            ----                    ----
       lock(sec_core:428:(regmap)->lock);
                                    lock(prepare_lock);
                                    lock(sec_core:428:(regmap)->lock);
       lock(prepare_lock);
*** DEADLOCK ***
Fix it by leaving the code prepared on probe and use {en,dis}able in
    the I2C transfer function.
This patch is similar to commit 34e81ad5f0b6 ("i2c: s3c2410: fix ABBA
    deadlock by keeping clock prepared") that fixes the same bug in other
    driver for an I2C controller found in Samsung SoCs.
Reported-by: Anand Moon linux.amoon@gmail.com
    Signed-off-by: Javier Martinez Canillas javier@osg.samsung.com
    Reviewed-by: Anand Moon linux.amoon@gmail.com
    Reviewed-by: Krzysztof Kozlowski k.kozlowski@samsung.com
    Signed-off-by: Wolfram Sang wsa@the-dreams.de
    Cc: stable@kernel.org
commit 609d5a1b2b35bb62b4b3750396e55453160c2a17
Author: Michael Ellerman mpe@ellerman.id.au
Date:   Wed Apr 13 13:59:14 2016 +1000
i2c: cpm: Fix build break due to incompatible pointer types
Since commit ea8daa7b9784 ("kbuild: Add option to turn incompatible
    pointer check into error"), assignments from an incompatible pointer
    types have become a hard error, eg:
drivers/i2c/busses/i2c-cpm.c:545:91: error: passing argument 3 of
      'dma_alloc_coherent' from incompatible pointer type
Fix the build break by converting txdma & rxdma to dma_addr_t.
Signed-off-by: Michael Ellerman mpe@ellerman.id.au
    Signed-off-by: Wolfram Sang wsa@the-dreams.de
    Cc: stable@kernel.org
    Fixes: ea8daa7b9784
commit d9676fa152c83b82137af950b1d4f629045d90c9
Author: Evgeny Voevodin evgeny.voevodin@intel.com
Date:   Wed Mar 23 12:26:52 2016 +0300
ARCv2: Enable LOCKDEP
- The asm helpers for calling into irq tracer were missing
- Add calls to above helpers in low level assembly entry code for ARCv2
- irq_save() uses CLRI to disable interrupts and returns the prev interrupt
      state (in STATUS32) in a specific encoding (and not the raw value of
      STATUS32). This is usable with SETI in irq_restore(). However
      save_flags() reads the raw value of STATUS32 which doesn't pair with
      irq_save/restore() and thus needs fixing.
Signed-off-by: Evgeny Voevodin evgeny.voevodin@intel.com
    [vgupta: updated changelog and also added some comments]
    Signed-off-by: Vineet Gupta vgupta@synopsys.com
commit c5b8b5beee1e2aadef0409dba555b7085d57910d
Author: Khalid Aziz khalid.aziz@oracle.com
Date:   Tue Apr 19 11:12:54 2016 -0600
sparc64: recognize and support Sonoma CPU type
Add code to recognize SPARC-Sonoma cpu correctly and update cpu hardware
    caps and cpu distribution map. SPARC-Sonoma is based upon SPARC-M7 core
    along with additional PCI functions added on and is reported by firmware
    as "SPARC-SN".
Signed-off-by: Khalid Aziz khalid.aziz@oracle.com
    Acked-by: Allen Pais allen.pais@oracle.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit 5bde2c9be701c4583f0a9243bd46590ec401bfba
Author: Adrian Glaubitz glaubitz@physik.fu-berlin.de
Date:   Thu Apr 14 20:14:42 2016 +0200
sparc: Implement and wire up vio_hotplug for vio.
Signed-off-by: John Paul Adrian Glaubitz glaubitz@physik.fu-berlin.de
    Acked-by: Sam Ravnborg sam@ravnborg.org
    Signed-off-by: David S. Miller davem@davemloft.net
commit 36128d204b81c099b5779771127a5546eac549c9
Author: Adrian Glaubitz glaubitz@physik.fu-berlin.de
Date:   Thu Apr 14 20:14:41 2016 +0200
sparc: Implement and wire up modalias_show for vio.
Signed-off-by: John Paul Adrian Glaubitz glaubitz@physik.fu-berlin.de
    Acked-by: Sam Ravnborg sam@ravnborg.org
    Signed-off-by: David S. Miller davem@davemloft.net
commit 9a78d4fc28904785ffe4c2d361e25b251b479704
Author: Sowmini Varadhan sowmini.varadhan@oracle.com
Date:   Mon Apr 11 17:57:05 2016 -0700
sparc/pci: Refactor dev_archdata initialization into pci_init_dev_archdata
The function pcibios_add_device() added by commit d0c31e020057
    ("sparc/PCI: Fix for panic while enabling SR-IOV") initializes
    the dev_archdata by doing a memcpy from the PF. This has the
    problem that it erroneously copies the OF device without
    explicitly refcounting it.
As David Miller pointed out: "Generally speaking we don't
    really support hot-plug for OF probed devices, but if we did
    all of the device tree pointers have to be refcounted properly."
To fix this error, and also avoid code duplication, this patch
    creates a new helper function, pci_init_dev_archdata(), that
    initializes the fields in dev_archdata, and can be invoked
    by callers after they have taken the needed refcounts
Signed-off-by: Sowmini Varadhan sowmini.varadhan@oracle.com
    Tested-by: Babu Moger babu.moger@oracle.com
    Reviewed-by: Khalid Aziz khalid.aziz@oracle.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit a95f94bc98754bad32cb7f36c867d71f3f2be729
Author: Borislav Petkov bp@suse.de
Date:   Wed Mar 30 13:42:47 2016 +0200
sparc/defconfigs: Remove CONFIG_IPV6_PRIVACY
Option is long gone, see
5d9efa7ee99e ("ipv6: Remove privacy config option.")
Signed-off-by: Borislav Petkov bp@suse.de
    Cc: sparclinux@vger.kernel.org
    Signed-off-by: David S. Miller davem@davemloft.net
commit 2144fff7df8e76654fa72b0a9d2324ce2e0c8a5c
Author: Lucas Stach l.stach@pengutronix.de
Date:   Thu Apr 21 13:52:38 2016 +0200
drm/etnaviv: don't move linear memory window on 3D cores without MC2.0
On cores with MC1.0 the memory window offset is not properly respected
    by all engines in the core, leading to different views of the memory
    if the offset in non-zero. This causes relocs for those engines to be
    wrong and might lead to other subtile problems.
Rather than trying to work around this, just disable the linear memory
    window offset for those cores.
Suggested-by: Russell King linux@arm.linux.org.uk
    Signed-off-by: Lucas Stach l.stach@pengutronix.de
commit 723cacbd9dc79582e562c123a0bacf8bfc69e72a
Author: Gerald Schaefer gerald.schaefer@de.ibm.com
Date:   Fri Apr 15 16:38:40 2016 +0200
s390/mm: fix asce_bits handling with dynamic pagetable levels
There is a race with multi-threaded applications between context switch and
    pagetable upgrade. In switch_mm() a new user_asce is built from mm->pgd and
    mm->context.asce_bits, w/o holding any locks. A concurrent mmap with a
    pagetable upgrade on another thread in crst_table_upgrade() could already
    have set new asce_bits, but not yet the new mm->pgd. This would result in a
    corrupt user_asce in switch_mm(), and eventually in a kernel panic from a
    translation exception.
Fix this by storing the complete asce instead of just the asce_bits, which
    can then be read atomically from switch_mm(), so that it either sees the
    old value or the new value, but no mixture. Both cases are OK. Having the
    old value would result in a page fault on access to the higher level memory,
    but the fault handler would see the new mm->pgd, if it was a valid access
    after the mmap on the other thread has completed. So as worst-case scenario
    we would have a page fault loop for the racing thread until the next time
    slice.
Also remove dead code and simplify the upgrade/downgrade path, there are no
    upgrades from 2 levels, and only downgrades from 3 levels for compat tasks.
    There are also no concurrent upgrades, because the mmap_sem is held with
    down_write() in do_mmap, so the flush and table checks during upgrade can
    be removed.
Reported-by: Michael Munday munday@ca.ibm.com
    Reviewed-by: Martin Schwidefsky schwidefsky@de.ibm.com
    Signed-off-by: Gerald Schaefer gerald.schaefer@de.ibm.com
    Signed-off-by: Martin Schwidefsky schwidefsky@de.ibm.com
commit dba599091c191d209b1499511a524ad9657c0e5a
Author: Sebastian Ott sebott@linux.vnet.ibm.com
Date:   Fri Apr 15 09:41:35 2016 +0200
s390/pci: fix use after free in dma_init
After a failure during registration of the dma_table (because of the
    function being in error state) we free its memory but don't reset the
    associated pointer to zero.
When we then receive a notification from firmware (about the function
    being in error state) we'll try to walk and free the dma_table again.
Fix this by resetting the dma_table pointer. In addition to that make
    sure that we free the iommu_bitmap when appropriate.
Signed-off-by: Sebastian Ott sebott@linux.vnet.ibm.com
    Reviewed-by: Gerald Schaefer gerald.schaefer@de.ibm.com
    Signed-off-by: Martin Schwidefsky schwidefsky@de.ibm.com
commit 8bbb6568428fa14c5bef120d443c20e0e7d52699
Author: Hans Verkuil hverkuil@xs4all.nl
Date:   Fri Apr 15 08:58:10 2016 -0300
[media] davinci_vpfe: Revert "staging: media: davinci_vpfe: remove,unnecessary ret variable"
This reverts commit afa5d19a2b5f ("staging: media: davinci_vpfe: remove
    unnecessary ret variable").
This patch is completely bogus and messed up the code big time.
I'm not sure what was intended, but this isn't it.
Cc: Thaissa Falbo thaissa.falbo@gmail.com
    Cc: Greg Kroah-Hartman gregkh@linuxfoundation.org
    Signed-off-by: Mauro Carvalho Chehab mchehab@osg.samsung.com
commit d5468d7afaa9c9e961e150f0455a14a9f4872a98
Author: Vladis Dronov vdronov@redhat.com
Date:   Sun Jan 31 14:14:52 2016 -0200
[media] usbvision: revert commit 588afcc1
Commit 588afcc1c0e4 ("[media] usbvision fix overflow of interfaces
    array")' should be reverted, because:
* "!dev->actconfig->interface[ifnum]" won't catch a case where the value
    is not NULL but some garbage. This way the system may crash later with
    GPF.
* "(ifnum >= USB_MAXINTERFACES)" does not cover all the error
    conditions. "ifnum" should be compared to "dev->actconfig->
    desc.bNumInterfaces", i.e. compared to the number of "struct
    usb_interface" kzalloc()-ed, not to USB_MAXINTERFACES.
* There is a "struct usb_device" leak in this error path, as there is
    usb_get_dev(), but no usb_put_dev() on this path.
* There is a bug of the same type several lines below with number of
    endpoints. The code is accessing hard-coded second endpoint
    ("interface->endpoint[1].desc") which may not exist. It would be great
    to handle this in the same patch too.
* All the concerns above are resolved by already-accepted commit fa52bd50
    ("[media] usbvision: fix crash on detecting device with invalid
    configuration")
* Mailing list message:
    http://www.spinics.net/lists/linux-media/msg94832.html
Signed-off-by: Vladis Dronov vdronov@redhat.com
    Signed-off-by: Hans Verkuil hans.verkuil@cisco.com
    Cc: stable@vger.kernel.org      # for v4.5
    Signed-off-by: Mauro Carvalho Chehab mchehab@osg.samsung.com
commit 6e1c7d6103fe7031035cec321307c6356809adf4
Author: Adrian Hunter adrian.hunter@intel.com
Date:   Fri Apr 15 14:06:57 2016 +0300
mmc: sdhci-acpi: Reduce Baytrail eMMC/SD/SDIO hangs
Baytrail eMMC/SD/SDIO host controllers have been known to
    hang.  A change to a hardware setting has been found to
    reduce the occurrence of such hangs.  This patch ensures
    the correct setting.
This patch applies cleanly to v4.4+.  It could go to
    earlier kernels also, so I will send backports to the
    stable list in due course.
Signed-off-by: Adrian Hunter adrian.hunter@intel.com
    Cc: stable@vger.kernel.org # v4.4+
    Signed-off-by: Ulf Hansson ulf.hansson@linaro.org
commit ab9f87c413c297cb9e7d544e0e634aaadc7fb87d
Author: Charles Keepax ckeepax@opensource.wolfsonmicro.com
Date:   Fri Apr 15 13:11:57 2016 +0100
ASoC: wm5102: Free compressed IRQ in CODEC remove
We request one of the DSP IRQs during CODEC probe, as such we should
    free it during CODEC remove, this patch does so.
Signed-off-by: Charles Keepax ckeepax@opensource.wolfsonmicro.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 54dca7015a7d6c09d34623c6ec61de30896186dd
Author: Charles Keepax ckeepax@opensource.wolfsonmicro.com
Date:   Fri Apr 15 13:11:56 2016 +0100
ASoC: arizona: Free speaker thermal IRQs in CODEC remove
The thermal warning IRQs for the speaker are requested in CODEC probe
    but never freed. This patch frees them in CODEC remove.
Signed-off-by: Charles Keepax ckeepax@opensource.wolfsonmicro.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab
Author: Sakari Ailus sakari.ailus@linux.intel.com
Date:   Sun Apr 3 16:31:03 2016 -0300
[media] videobuf2-v4l2: Verify planes array in buffer dequeueing
When a buffer is being dequeued using VIDIOC_DQBUF IOCTL, the exact buffer
    which will be dequeued is not known until the buffer has been removed from
    the queue. The number of planes is specific to a buffer, not to the queue.
This does lead to the situation where multi-plane buffers may be requested
    and queued with n planes, but VIDIOC_DQBUF IOCTL may be passed an argument
    struct with fewer planes.
__fill_v4l2_buffer() however uses the number of planes from the dequeued
    videobuf2 buffer, overwriting kernel memory (the m.planes array allocated
    in video_usercopy() in v4l2-ioctl.c)  if the user provided fewer
    planes than the dequeued buffer had. Oops!
Fixes: b0e0e1f83de3 ("[media] media: videobuf2: Prepare to divide videobuf2")
Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com
    Acked-by: Hans Verkuil hans.verkuil@cisco.com
    Cc: stable@vger.kernel.org # for v4.4 and later
    Signed-off-by: Mauro Carvalho Chehab mchehab@osg.samsung.com
commit e7e0c3e26587749b62d17b9dd0532874186c77f7
Author: Sakari Ailus sakari.ailus@linux.intel.com
Date:   Sun Apr 3 16:15:00 2016 -0300
[media] videobuf2-core: Check user space planes array in dqbuf
The number of planes in videobuf2 is specific to a buffer. In order to
    verify that the planes array provided by the user is long enough, a new
    vb2_buf_op is required.
Call __verify_planes_array() when the dequeued buffer is known. Return an
    error to the caller if there was one, otherwise remove the buffer from the
    done list.
Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com
    Acked-by: Hans Verkuil hans.verkuil@cisco.com
    Cc: stable@vger.kernel.org # for v4.4 and later
    Signed-off-by: Mauro Carvalho Chehab mchehab@osg.samsung.com
commit abaa7b0c1286ca1610a6dfa079e1d2e27dca1f25
Author: Mika Westerberg mika.westerberg@linux.intel.com
Date:   Fri Apr 8 15:41:08 2016 +0300
i2c: ismt: Add Intel DNV PCI ID
Intel DNV has the same iSMT SMBus host controller than Intel Avoton. Add
    DNV PCI ID to the list of supported devices.
Signed-off-by: Mika Westerberg mika.westerberg@linux.intel.com
    Acked-by: Andy Shevchenko andriy.shevchenko@linux.intel.com
    Acked-by: Neil Horman nhorman@tuxdriver.com
    Signed-off-by: Wolfram Sang wsa@the-dreams.de
commit 8574ad7800ad298dc7f184f12b454a67fa3dd839
Author: Tanmay Jagdale tanmay.jagdale@broadcom.com
Date:   Mon Apr 11 18:01:26 2016 +0530
i2c: xlp9xx: add support for Broadcom Vulcan
The Broadcom Vulcan ARM64 processor uses the same I2C controller
    present on the Broadcom XLP9xx/5xx MIPS processor family.
    Updated the Kconfig by adding ARCH_VULCAN option.
Signed-off-by: Tanmay Jagdale tanmay.jagdale@broadcom.com
    Signed-off-by: Wolfram Sang wsa@the-dreams.de
commit b0b6d123f5df189d7d3a62d450e5f5c33ad614d8
Author: Yakir Yang ykk@rock-chips.com
Date:   Mon Mar 14 11:09:15 2016 +0800
i2c: rk3x: add support for rk3228
Enable the I2C core for this SoC.
Signed-off-by: Yakir Yang ykk@rock-chips.com
    Reviewed-by: Heiko Stuebner heiko@sntech.de
    Acked-by: Rob Herring robh@kernel.org
    Signed-off-by: Wolfram Sang wsa@the-dreams.de
commit ce0e2c60e69e5f87ab4ac10c935d8bd85d4d11f7
Author: Linus Walleij linus.walleij@linaro.org
Date:   Tue Apr 12 10:05:22 2016 +0200
Revert "gpio: rcar: Fine-grained Runtime PM support"
This reverts commit 65194cb174b873448b208eb6e04ecb72237af76e.
commit 42c25013ca95ce79b4ed192188ca843ae48f8c71
Author: Linus Walleij linus.walleij@linaro.org
Date:   Tue Apr 12 10:00:34 2016 +0200
Revert "gpio: rcar: Add Runtime PM handling for interrupts"
This reverts commit b26a719bdba9aa926ceaadecc66e07623d2b8a53.
commit f0c8e1d9c4f473dfc771a613b602f1841afe8f8b
Author: Subhransu S. Prusty subhransu.s.prusty@intel.com
Date:   Tue Apr 12 10:31:23 2016 +0530
ASoC: Intel: Skylake: Fix ibs/obs calc for non-integral sampling rates
FW expects sampling rate rounded up to next higher integer value
    when calculating ibs/obs. For example for 44.1k, it should be
    rounded up to 45 to calculate ibs/obs.
Signed-off-by: Subhransu S. Prusty subhransu.s.prusty@intel.com
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit b8af8b1d80db13dd4f5e5a3698180bd9c14aee03
Author: Dan Carpenter dan.carpenter@oracle.com
Date:   Wed Apr 6 14:36:06 2016 +0300
ASoC: Intel: sst: fix a loop timeout in sst_hsw_stream_reset()
In the original code we ended the loop with tries set to -1 instead of
    zero.
Signed-off-by: Dan Carpenter dan.carpenter@oracle.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit af037412629d8549e04039a57cf99a59b6e7a01b
Author: Subhransu S. Prusty subhransu.s.prusty@intel.com
Date:   Fri Apr 1 13:36:27 2016 +0530
ASoC: Intel: Skylake: Fix to turn OFF codec power when entering S3
Signed-off-by: Subhransu S. Prusty subhransu.s.prusty@intel.com
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 1b377ccddd14cd04df4b9523a426b34f928002bc
Author: Subhransu S. Prusty subhransu.s.prusty@intel.com
Date:   Fri Apr 1 13:36:26 2016 +0530
ASoC: hdac_hdmi: Fix codec power state in S3 during playback
If the system enters S3 during a playback, codec power needs to
    be turned OFF during suspend and restored during resume. With
    this patch the AFG node is set to D3 and codec power is turned
    OFF during controller suspend call.
During resume, the codec power is left in ON state if the
    playback was in progress while suspending.
Also setting power state for AFG node is optimized. With this the
    loop with timeout is removed and codec_read is used instead.
Signed-off-by: Subhransu S. Prusty subhransu.s.prusty@intel.com
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 0fee1798af81b1428d8d5886ea48116444e635fc
Author: Subhransu S. Prusty subhransu.s.prusty@intel.com
Date:   Fri Apr 1 13:36:25 2016 +0530
ASoC: hdac_hdmi: Fix to use dev_pm ops instead soc pm
Use dev_pm ops feature instead of soc pm as core assumes system
    is capable of direct complete. Register with complete callback
    instead of resume to synchronize with Jack notification from
    display driver. This ensures correct Jack notification to user
    space.
Signed-off-by: Subhransu S. Prusty subhransu.s.prusty@intel.com
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 5ec712934ce1ff6e33bf3878034a91ca9bd600c9
Author: David S. Miller davem@davemloft.net
Date:   Tue Mar 29 18:39:26 2016 -0700
sparc: Write up preadv2/pwritev2 syscalls.
Signed-off-by: David S. Miller davem@davemloft.net
commit d0c31e02005764dae0aab130a57e9794d06b824d
Author: Babu Moger babu.moger@oracle.com
Date:   Thu Mar 24 13:02:22 2016 -0700
sparc/PCI: Fix for panic while enabling SR-IOV
We noticed this panic while enabling SR-IOV in sparc.
mlx4_core: Mellanox ConnectX core driver v2.2-1 (Jan  1 2015)
    mlx4_core: Initializing 0007:01:00.0
    mlx4_core 0007:01:00.0: Enabling SR-IOV with 5 VFs
    mlx4_core: Initializing 0007:01:00.1
    Unable to handle kernel NULL pointer dereference
    insmod(10010): Oops [#1]
    CPU: 391 PID: 10010 Comm: insmod Not tainted
    		4.1.12-32.el6uek.kdump2.sparc64 #1
    TPC: <dma_supported+0x20/0x80>
    I7: <__mlx4_init_one+0x324/0x500 [mlx4_core]>
    Call Trace:
     [00000000104c5ea4] __mlx4_init_one+0x324/0x500 [mlx4_core]
     [00000000104c613c] mlx4_init_one+0xbc/0x120 [mlx4_core]
     [0000000000725f14] local_pci_probe+0x34/0xa0
     [0000000000726028] pci_call_probe+0xa8/0xe0
     [0000000000726310] pci_device_probe+0x50/0x80
     [000000000079f700] really_probe+0x140/0x420
     [000000000079fa24] driver_probe_device+0x44/0xa0
     [000000000079fb5c] __device_attach+0x3c/0x60
     [000000000079d85c] bus_for_each_drv+0x5c/0xa0
     [000000000079f588] device_attach+0x88/0xc0
     [000000000071acd0] pci_bus_add_device+0x30/0x80
     [0000000000736090] virtfn_add.clone.1+0x210/0x360
     [00000000007364a4] sriov_enable+0x2c4/0x520
     [000000000073672c] pci_enable_sriov+0x2c/0x40
     [00000000104c2d58] mlx4_enable_sriov+0xf8/0x180 [mlx4_core]
     [00000000104c49ac] mlx4_load_one+0x42c/0xd40 [mlx4_core]
    Disabling lock debugging due to kernel taint
    Caller[00000000104c5ea4]: __mlx4_init_one+0x324/0x500 [mlx4_core]
    Caller[00000000104c613c]: mlx4_init_one+0xbc/0x120 [mlx4_core]
    Caller[0000000000725f14]: local_pci_probe+0x34/0xa0
    Caller[0000000000726028]: pci_call_probe+0xa8/0xe0
    Caller[0000000000726310]: pci_device_probe+0x50/0x80
    Caller[000000000079f700]: really_probe+0x140/0x420
    Caller[000000000079fa24]: driver_probe_device+0x44/0xa0
    Caller[000000000079fb5c]: __device_attach+0x3c/0x60
    Caller[000000000079d85c]: bus_for_each_drv+0x5c/0xa0
    Caller[000000000079f588]: device_attach+0x88/0xc0
    Caller[000000000071acd0]: pci_bus_add_device+0x30/0x80
    Caller[0000000000736090]: virtfn_add.clone.1+0x210/0x360
    Caller[00000000007364a4]: sriov_enable+0x2c4/0x520
    Caller[000000000073672c]: pci_enable_sriov+0x2c/0x40
    Caller[00000000104c2d58]: mlx4_enable_sriov+0xf8/0x180 [mlx4_core]
    Caller[00000000104c49ac]: mlx4_load_one+0x42c/0xd40 [mlx4_core]
    Caller[00000000104c5f90]: __mlx4_init_one+0x410/0x500 [mlx4_core]
    Caller[00000000104c613c]: mlx4_init_one+0xbc/0x120 [mlx4_core]
    Caller[0000000000725f14]: local_pci_probe+0x34/0xa0
    Caller[0000000000726028]: pci_call_probe+0xa8/0xe0
    Caller[0000000000726310]: pci_device_probe+0x50/0x80
    Caller[000000000079f700]: really_probe+0x140/0x420
    Caller[000000000079fa24]: driver_probe_device+0x44/0xa0
    Caller[000000000079fb08]: __driver_attach+0x88/0xa0
    Caller[000000000079d90c]: bus_for_each_dev+0x6c/0xa0
    Caller[000000000079f29c]: driver_attach+0x1c/0x40
    Caller[000000000079e35c]: bus_add_driver+0x17c/0x220
    Caller[00000000007a02d4]: driver_register+0x74/0x120
    Caller[00000000007263fc]: __pci_register_driver+0x3c/0x60
    Caller[00000000104f62bc]: mlx4_init+0x60/0xcc [mlx4_core]
    Kernel panic - not syncing: Fatal exception
    Press Stop-A (L1-A) to return to the boot prom
    ---[ end Kernel panic - not syncing: Fatal exception
Details:
    Here is the call sequence
    virtfn_add->__mlx4_init_one->dma_set_mask->dma_supported
The panic happened at line 760(file arch/sparc/kernel/iommu.c)
758 int dma_supported(struct device *dev, u64 device_mask)
    759 {
    760         struct iommu *iommu = dev->archdata.iommu;
    761         u64 dma_addr_mask = iommu->dma_addr_mask;
    762
    763         if (device_mask >= (1UL << 32UL))
    764                 return 0;
    765
    766         if ((device_mask & dma_addr_mask) == dma_addr_mask)
    767                 return 1;
    768
    769 #ifdef CONFIG_PCI
    770         if (dev_is_pci(dev))
    771		return pci64_dma_supported(to_pci_dev(dev), device_mask);
    772 #endif
    773
    774         return 0;
    775 }
    776 EXPORT_SYMBOL(dma_supported);
Same panic happened with Intel ixgbe driver also.
SR-IOV code looks for arch specific data while enabling
    VFs. When VF device is added, driver probe function makes set
    of calls to initialize the pci device. Because the VF device is
    added different way than the normal PF device(which happens via
    of_create_pci_dev for sparc), some of the arch specific initialization
    does not happen for VF device.  That causes panic when archdata is
    accessed.
To fix this, I have used already defined weak function
    pcibios_setup_device to copy archdata from PF to VF.
    Also verified the fix.
Signed-off-by: Babu Moger babu.moger@oracle.com
    Signed-off-by: Sowmini Varadhan sowmini.varadhan@oracle.com
    Reviewed-by: Ethan Zhao ethan.zhao@oracle.com
    Signed-off-by: David S. Miller davem@davemloft.net
commit 33362c69c8e68281633a7c3a1d5c840e940097b7
Author: Charles Keepax ckeepax@opensource.wolfsonmicro.com
Date:   Mon Mar 28 10:47:34 2016 +0100
ASoC: wm8962: Correct typo when setting DSPCLK rate
The variable dspclk holds the rate of the DSPCLK, but the variable
    sysclk holds an identifier for the clock. Currently if read a
    non-sensical value from the DSPCLK_DIV register we assign sysclk to
    dspclk, clearly this was intended to be sysclk_rate.
Signed-off-by: Charles Keepax ckeepax@opensource.wolfsonmicro.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit e6cee90075c0ff261ff7eef8ad892429f028e194
Author: Ben Zhang benzh@chromium.org
Date:   Fri Mar 25 16:10:39 2016 -0700
ASoC: nau8825: Fix jack detection across suspend
Jack plug status is rechecked at resume to handle plug/unplug
    in S3 when the chip has no power.
Suspend/resume callbacks are moved from the i2c dev_pm_ops to
    snd_soc_codec_driver. soc_resume_deferred is a delayed work
    which may trigger nau8825_set_bias_level. The bias change races
    against dev_pm_ops, causing jack detection issues.
    soc_resume_deferred ensures bias change and snd_soc_codec_driver
    suspend/resume are sequenced correctly.
Signed-off-by: Ben Zhang benzh@chromium.org
    Signed-off-by: Mark Brown broonie@kernel.org
commit 4f329d9fbab630af44db2f787eb79ca52e6ba22e
Author: Jeeja KP jeeja.kp@intel.com
Date:   Mon Mar 28 22:11:31 2016 +0530
ASoC: Intel: Skylake: Fix DSP resource de-allocation
In PRE PMD of widget handler DSP resources are allocated after
    the creation of DSP pipe and modules and in POST PMD DSP
    resources are destroyed.
If there is any failure in pipe or module creation in PRE PMD,
    pcm trigger fails and finally POST PMD gets called and DSP
    resources are freed, without getting allocated.
Fixes the DSP resource de-allocation by allocating the resource
    before creation of pipe and module in PRE PMD and in POST PMD,
    free the resources.
Signed-off-by: Jeeja KP jeeja.kp@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit d643678b9a4e432a574b2ec601216afd720c69b6
Author: Jeeja KP jeeja.kp@intel.com
Date:   Mon Mar 28 22:11:30 2016 +0530
ASoC: Intel: Skylake: Fix for unloading module only when it is loaded
Module needs to be unloaded only when it is loaded successfully.
    To fix this, first correct the module state sequence and set module
    state to LOADED if module is loaded successfully.
    When unloading the module check if module state is not in UNINIT,
    then unload it.
Signed-off-by: Jeeja KP jeeja.kp@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit c3efb42b207e22991dee86ca15861ede11a419fc
Author: Vinod Koul vinod.koul@intel.com
Date:   Fri Mar 18 20:10:23 2016 +0530
ASoC: Intel: Skylake: Fix kbuild dependency
The Skylake driver selects SND_HDA_I915 which causes kbuild to spew warning:
warning: (SND_SOC_INTEL_SKYLAKE) selects SND_HDA_I915 which has unmet direct dependencies
      (SOUND && !M68K && !UML && SND && DRM_I915 && SND_HDA_CORE)
The SND_HDA_I915 should not be selected so drop that.
Reported-by: Takashi Iwai tiwai@suse.de
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 47325078f2a3e543150e7df967e45756b2fff7ec
Author: Mark Brown broonie@kernel.org
Date:   Fri Mar 18 12:04:23 2016 +0000
ASoC: dapm: Make sure we have a card when displaying component widgets
The dummy component is reused for all cards so we special case and don't
    bind it to any of them.  This means that code like that displaying the
    component widgets that tries to look at the card will crash.  In the
    future we will fix this by ensuring that the dummy component looks like
    other components but that is invasive and so not suitable for a fix.
    Instead add a special case check here.
Reported-by: Harry Pan harry.pan@intel.com
    Suggested-by: Lars-Peter Clausen lars@metafoo.de
    Signed-off-by: Mark Brown broonie@kernel.org
    Cc: stable@vger.kernel.org
commit 653aa4645244042826f105aab1be3d01b3d493ca
Author: Sugar Zhang sugar.zhang@rock-chips.com
Date:   Fri Mar 18 14:54:22 2016 +0800
ASoC: rt5640: Correct the digital interface data select
this patch corrects the interface adc/dac control register definition
    according to datasheet.
Signed-off-by: Sugar Zhang sugar.zhang@rock-chips.com
    Signed-off-by: Mark Brown broonie@kernel.org
    Cc: stable@vger.kernel.org
commit 36e7972c0d3f8819a5d9335c36c5dcd168cd2b72
Author: Vinod Koul vinod.koul@intel.com
Date:   Wed Mar 16 21:51:31 2016 +0530
ASoC: Intel: Skylake: remove call to pci_dev_put
The PCI bus takes pci_dev_get() and pci_dev_put() is also there.
    So no need for drivers to invoke these. In SKL driver we were
    calling pci_dev_put() only which is not right, so remove this
Signed-off-by: Jeeja KP jeeja.kp@intel.com
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 5b2fe89856b2d0faaaea9e4b4b2c4920de7a600c
Author: Vinod Koul vinod.koul@intel.com
Date:   Tue Mar 15 16:39:27 2016 +0530
ASoC: Intel: Skylake: Call i915 exit last
The Skylake driver uses i915 component APIs to talk to display.
    On remove we should free up by invoking snd_hdac_i915_exit() but
    that should be last thing in remove routine, so move it to last
    in skl_free()
Signed-off-by: Jeeja KP jeeja.kp@intel.com
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 077411e5eb8872736fdc5f3e7277719160918dde
Author: Vinod Koul vinod.koul@intel.com
Date:   Tue Mar 15 16:39:26 2016 +0530
ASoC: Intel: Skylake: Unmap the address last
In Skylake destructor we unmap the hardware address and then free
    links and streams. The stream free accesses hardware to write to
    registers and predictably causes oops.
So change the order and unmap last in destructor.
Signed-off-by: Jeeja KP jeeja.kp@intel.com
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 3f7f8489e25b180cf8de8a3ae3896b3f18fc4aa5
Author: Vinod Koul vinod.koul@intel.com
Date:   Tue Mar 15 16:39:25 2016 +0530
ASoC: Intel: Skylake: Freeup properly on skl_dsp_free
We are supposed to freeup the Code loader DMA allocation and
    ensure all interrupts are disabled before we disable dsp cores.
    So invoke these to ensure DSP shuts down properly.
Signed-off-by: Jeeja KP jeeja.kp@intel.com
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 7373f481dc4098a844a756201e98341bc56baaa2
Author: Vinod Koul vinod.koul@intel.com
Date:   Tue Mar 15 16:39:24 2016 +0530
ASoC: Intel: Skylake: free codec objects on removal
On driver removal we should ask the core to remove the device
    objects as well, so invoke snd_hdac_ext_bus_device_remove() in
    remove.
Signed-off-by: Jeeja KP jeeja.kp@intel.com
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit 4a6c5e6a8d29e4d33858227db9179e91aa8a7407
Author: Vinod Koul vinod.koul@intel.com
Date:   Tue Mar 15 16:39:23 2016 +0530
ALSA: hda: use list macro for parsing on cleanup
It is always better to use list_for_each_entry_safe() while doing
    cleanup. So use this instead of open coding this in list in
    snd_hdac_stream_free_all()
Signed-off-by: Jeeja KP jeeja.kp@intel.com
    Acked-by: Takashi Iwai tiwai@suse.de
    Signed-off-by: Vinod Koul vinod.koul@intel.com
    Signed-off-by: Mark Brown broonie@kernel.org
commit af139d5592bc812e7a1997727172ddba3e6be968
Author: Arnd Bergmann arnd@arndb.de
Date:   Tue Mar 15 22:42:50 2016 +0100
ASoC: rt5616: add I2C dependency
The rt5616 codec registers itself as an i2c driver, but can
    be enabled even when i2c is turned off, which leads to a build
    error:
codecs/rt5616.c:1419:1: error: data definition has no type or storage class [-Werror]
     module_i2c_driver(rt5616_i2c_driver);
This adds an explicit Kconfig dependency, like the other codec
    drivers.
Signed-off-by: Arnd Bergmann arnd@arndb.de
    Fixes: 288bc356a881 ("ASoC: rt5616: allow to build with CONFIG_SND_SOC_RT5616")
    Signed-off-by: Mark Brown broonie@kernel.org
commit dd5dc001581a7cf6f563e188c302caae1be998c2
Author: Arnd Bergmann arnd@arndb.de
Date:   Mon Mar 14 15:49:54 2016 +0100
ASoC: cs35l32: avoid uninitialized variable access
gcc warns about the possibilty of accessing a property read from
    devicetree in cs35l32_i2c_probe() when it has not been initialized
    because CONFIG_OF is disabled:
sound/soc/codecs/cs35l32.c: In function 'cs35l32_i2c_probe':
    sound/soc/codecs/cs35l32.c:278:2: warning: 'val' may be used uninitialized in this function [-Wmaybe-uninitialized]
The code is actually correct because it checks the dev->of_node
    variable first and we know this is NULL here when CONFIG_OF
    is disabled, but Russell King noticed that it's broken when
    we probe the device using DT, and the properties are absent.
The code already has some checking for incorrect values, and
    I keep that checking unchanged here, but add an additional
    check for an error returned by the property accessor functions
    that now gets handled the same way as incorrect data in the
    properties.
Signed-off-by: Arnd Bergmann arnd@arndb.de
    Acked-by: Brian Austin brian.austin@cirrus.com
    Signed-off-by: Mark Brown broonie@kernel.org
-----------------------------------------------------------------------
-- 
linux integration