Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Script options fix #80

Closed
wants to merge 8 commits into from
Closed

Script options fix #80

wants to merge 8 commits into from

Conversation

abak
Copy link
Contributor

@abak abak commented Mar 17, 2014

This pull request fixes the following issues :

  • when passing custom arguments to a script, if those arguments are not declared within perf, they prevent the execution of perf.
    e.g.
perf script -i path/to/perf.data -s my_script -arg1 arg_value

perf will issue an error message and no processing will occur

  • when passing custom arguments to a script, if those arguments are declared by perf, they are consumed and not passed to the script.
    e.g.
perf script -i path/to/perf.data -s my_script -h

perf will display its own help message, instead of the expected help message from my_script.

These issues are addressed as follows :

  • The parse option flag is changed from PARSE_OPT_STOP_AT_NON_OPTION to PARSE_OPT_KEEP_UNKNOWN
  • A new option type is introduce OPT_CALLBACK_FINAL_OPTION, which effectively prevents the parsing of all options located after the script.

@abak
Copy link
Contributor Author

abak commented Mar 18, 2014

submitted through proper channels

@abak abak closed this Mar 18, 2014
Puneeth-n pushed a commit to Puneeth-n/linux that referenced this pull request Mar 18, 2014
@bp3tk0v
x86/boot: Further compress CPUs bootup message
a17bce4 
Turn it into (for example):

[    0.073380] x86: Booting SMP configuration:
[    0.074005] .... node   #0, CPUs:          alexander-zimmermann#1   #2   #3   #4   #5   torvalds#6   torvalds#7
[    0.603005] .... node   alexander-zimmermann#1, CPUs:     torvalds#8   torvalds#9  torvalds#10  torvalds#11  torvalds#12  torvalds#13  torvalds#14  torvalds#15
[    1.200005] .... node   #2, CPUs:    torvalds#16  torvalds#17  torvalds#18  torvalds#19  torvalds#20  torvalds#21  torvalds#22  torvalds#23
[    1.796005] .... node   #3, CPUs:    torvalds#24  torvalds#25  torvalds#26  torvalds#27  torvalds#28  torvalds#29  torvalds#30  torvalds#31
[    2.393005] .... node   #4, CPUs:    torvalds#32  torvalds#33  torvalds#34  torvalds#35  torvalds#36  torvalds#37  torvalds#38  torvalds#39
[    2.996005] .... node   #5, CPUs:    torvalds#40  torvalds#41  torvalds#42  torvalds#43  torvalds#44  torvalds#45  torvalds#46  torvalds#47
[    3.600005] .... node   torvalds#6, CPUs:    torvalds#48  torvalds#49  torvalds#50  torvalds#51  #52  #53  torvalds#54  torvalds#55
[    4.202005] .... node   torvalds#7, CPUs:    torvalds#56  torvalds#57  #58  torvalds#59  torvalds#60  torvalds#61  torvalds#62  torvalds#63
[    4.811005] .... node   torvalds#8, CPUs:    torvalds#64  torvalds#65  torvalds#66  torvalds#67  torvalds#68  torvalds#69  #70  torvalds#71
[    5.421006] .... node   torvalds#9, CPUs:    torvalds#72  torvalds#73  torvalds#74  torvalds#75  torvalds#76  torvalds#77  torvalds#78  torvalds#79
[    6.032005] .... node  torvalds#10, CPUs:    torvalds#80  torvalds#81  torvalds#82  torvalds#83  torvalds#84  torvalds#85  torvalds#86  torvalds#87
[    6.648006] .... node  torvalds#11, CPUs:    torvalds#88  torvalds#89  torvalds#90  torvalds#91  torvalds#92  torvalds#93  torvalds#94  torvalds#95
[    7.262005] .... node  torvalds#12, CPUs:    torvalds#96  torvalds#97  torvalds#98  torvalds#99 torvalds#100 torvalds#101 torvalds#102 torvalds#103
[    7.865005] .... node  torvalds#13, CPUs:   torvalds#104 torvalds#105 torvalds#106 torvalds#107 torvalds#108 torvalds#109 torvalds#110 torvalds#111
[    8.466005] .... node  torvalds#14, CPUs:   torvalds#112 torvalds#113 torvalds#114 torvalds#115 torvalds#116 torvalds#117 torvalds#118 torvalds#119
[    9.073006] .... node  torvalds#15, CPUs:   torvalds#120 torvalds#121 torvalds#122 torvalds#123 torvalds#124 torvalds#125 torvalds#126 torvalds#127
[    9.679901] x86: Booted up 16 nodes, 128 CPUs

and drop useless elements.

Change num_digits() to hpa's division-avoiding, cell-phone-typed
version which he went at great lengths and pains to submit on a
Saturday evening.

Signed-off-by: Borislav Petkov <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: Linus Torvalds <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>
Puneeth-n pushed a commit to Puneeth-n/linux that referenced this pull request Mar 18, 2014
@shawnguo2
ARM: imx: use __initconst for const init definition
df79bc9 
0-DAY kernel build testing backend reports the following.

 scripts/checkpatch.pl 0001-ARM-imx-add-support-code-for-IMX50-based-machines.patch
 # many are suggestions rather than must-fix

 ERROR: Use of const init definition must use __initconst
 torvalds#80: arch/arm/mach-imx/mach-imx50.c:26:
 +static const char *imx50_dt_board_compat[] __initdata = {

While at it, fix the error globally for IMX platform.

Reported-by: Fengguang Wu <[email protected]>
Acked-by: Greg Ungerer <[email protected]>
Signed-off-by: Shawn Guo <[email protected]>
ystk pushed a commit to ystk/linux-ltsi-work that referenced this pull request Apr 29, 2014
@vitkyrka
mm: cma: don't replace lowmem pages with highmem
6503184 
The filesystem layer expects pages in the block device's mapping to not
be in highmem (the mapping's gfp mask is set in bdget()), but CMA can
currently replace lowmem pages with highmem pages, leading to crashes in
filesystem code such as the one below:

  Unable to handle kernel NULL pointer dereference at virtual address 00000400
  pgd = c0c98000
  [00000400] *pgd=00c91831, *pte=00000000, *ppte=00000000
  Internal error: Oops: 817 [#1] PREEMPT SMP ARM
  CPU: 0    Not tainted  (3.5.0-rc5+ torvalds#80)
  PC is at __memzero+0x24/0x80
  ...
  Process fsstress (pid: 323, stack limit = 0xc0cbc2f0)
  Backtrace:
  [<c010e3f0>] (ext4_getblk+0x0/0x180) from [<c010e58c>] (ext4_bread+0x1c/0x98)
  [<c010e570>] (ext4_bread+0x0/0x98) from [<c0117944>] (ext4_mkdir+0x160/0x3bc)
   r4:c15337f0
  [<c01177e4>] (ext4_mkdir+0x0/0x3bc) from [<c00c29e0>] (vfs_mkdir+0x8c/0x98)
  [<c00c2954>] (vfs_mkdir+0x0/0x98) from [<c00c2a60>] (sys_mkdirat+0x74/0xac)
   r6:00000000 r5:c152eb40 r4:000001ff r3:c14b43f0
  [<c00c29ec>] (sys_mkdirat+0x0/0xac) from [<c00c2ab8>] (sys_mkdir+0x20/0x24)
   r6:beccdcf0 r5:00074000 r4:beccdbbc
  [<c00c2a98>] (sys_mkdir+0x0/0x24) from [<c000e3c0>] (ret_fast_syscall+0x0/0x30)

Fix this by replacing only highmem pages with highmem.

Reported-by: Laura Abbott <[email protected]>
Signed-off-by: Rabin Vincent <[email protected]>
Acked-by: Michal Nazarewicz <[email protected]>
Signed-off-by: Marek Szyprowski <[email protected]>
(cherry picked from commit 6a6dccb)

Signed-off-by: Damian Hobson-Garcia <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
ystk pushed a commit to ystk/linux-ltsi-work that referenced this pull request Apr 29, 2014
@vitkyrka
mm: cma: don't replace lowmem pages with highmem
6066985 
The filesystem layer expects pages in the block device's mapping to not
be in highmem (the mapping's gfp mask is set in bdget()), but CMA can
currently replace lowmem pages with highmem pages, leading to crashes in
filesystem code such as the one below:

  Unable to handle kernel NULL pointer dereference at virtual address 00000400
  pgd = c0c98000
  [00000400] *pgd=00c91831, *pte=00000000, *ppte=00000000
  Internal error: Oops: 817 [#1] PREEMPT SMP ARM
  CPU: 0    Not tainted  (3.5.0-rc5+ torvalds#80)
  PC is at __memzero+0x24/0x80
  ...
  Process fsstress (pid: 323, stack limit = 0xc0cbc2f0)
  Backtrace:
  [<c010e3f0>] (ext4_getblk+0x0/0x180) from [<c010e58c>] (ext4_bread+0x1c/0x98)
  [<c010e570>] (ext4_bread+0x0/0x98) from [<c0117944>] (ext4_mkdir+0x160/0x3bc)
   r4:c15337f0
  [<c01177e4>] (ext4_mkdir+0x0/0x3bc) from [<c00c29e0>] (vfs_mkdir+0x8c/0x98)
  [<c00c2954>] (vfs_mkdir+0x0/0x98) from [<c00c2a60>] (sys_mkdirat+0x74/0xac)
   r6:00000000 r5:c152eb40 r4:000001ff r3:c14b43f0
  [<c00c29ec>] (sys_mkdirat+0x0/0xac) from [<c00c2ab8>] (sys_mkdir+0x20/0x24)
   r6:beccdcf0 r5:00074000 r4:beccdbbc
  [<c00c2a98>] (sys_mkdir+0x0/0x24) from [<c000e3c0>] (ret_fast_syscall+0x0/0x30)

Fix this by replacing only highmem pages with highmem.

Reported-by: Laura Abbott <[email protected]>
Signed-off-by: Rabin Vincent <[email protected]>
Acked-by: Michal Nazarewicz <[email protected]>
Signed-off-by: Marek Szyprowski <[email protected]>
(cherry picked from commit 6a6dccb)

Signed-off-by: Damian Hobson-Garcia <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
ystk pushed a commit to ystk/linux-ltsi-work that referenced this pull request Apr 29, 2014
@vitkyrka
mm: cma: don't replace lowmem pages with highmem
a457ea1 
The filesystem layer expects pages in the block device's mapping to not
be in highmem (the mapping's gfp mask is set in bdget()), but CMA can
currently replace lowmem pages with highmem pages, leading to crashes in
filesystem code such as the one below:

  Unable to handle kernel NULL pointer dereference at virtual address 00000400
  pgd = c0c98000
  [00000400] *pgd=00c91831, *pte=00000000, *ppte=00000000
  Internal error: Oops: 817 [#1] PREEMPT SMP ARM
  CPU: 0    Not tainted  (3.5.0-rc5+ torvalds#80)
  PC is at __memzero+0x24/0x80
  ...
  Process fsstress (pid: 323, stack limit = 0xc0cbc2f0)
  Backtrace:
  [<c010e3f0>] (ext4_getblk+0x0/0x180) from [<c010e58c>] (ext4_bread+0x1c/0x98)
  [<c010e570>] (ext4_bread+0x0/0x98) from [<c0117944>] (ext4_mkdir+0x160/0x3bc)
   r4:c15337f0
  [<c01177e4>] (ext4_mkdir+0x0/0x3bc) from [<c00c29e0>] (vfs_mkdir+0x8c/0x98)
  [<c00c2954>] (vfs_mkdir+0x0/0x98) from [<c00c2a60>] (sys_mkdirat+0x74/0xac)
   r6:00000000 r5:c152eb40 r4:000001ff r3:c14b43f0
  [<c00c29ec>] (sys_mkdirat+0x0/0xac) from [<c00c2ab8>] (sys_mkdir+0x20/0x24)
   r6:beccdcf0 r5:00074000 r4:beccdbbc
  [<c00c2a98>] (sys_mkdir+0x0/0x24) from [<c000e3c0>] (ret_fast_syscall+0x0/0x30)

Fix this by replacing only highmem pages with highmem.

Reported-by: Laura Abbott <[email protected]>
Signed-off-by: Rabin Vincent <[email protected]>
Acked-by: Michal Nazarewicz <[email protected]>
Signed-off-by: Marek Szyprowski <[email protected]>
(cherry picked from commit 6a6dccb)

Signed-off-by: Damian Hobson-Garcia <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
aryabinin pushed a commit to aryabinin/linux that referenced this pull request Aug 18, 2014
@gregkh
staging: dgnc: Fix externs should be avoided in the .c files
1e88100 
This commit fixes the following checkpatch warnings:

WARNING: externs should be avoided in .c files
    torvalds#80: FILE: drivers/staging/dgnc/dgnc_driver.c:80:
        +int            dgnc_init_module(void);
    torvalds#81: FILE: drivers/staging/dgnc/dgnc_driver.c:81:
        +void           dgnc_cleanup_module(void);

This was caused by putting the declarations for module init and module
exit fucntions on the top of the file. The fix removes these
declarations plus it also corrects the type of the init/exit functions.

Due to the dependency between init and exit functions the
dgnc_cleanup_module had to be put first.

Signed-off-by: Konrad Zapalowicz <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
rzr pushed a commit to rzr/linux that referenced this pull request Sep 8, 2014
@ssvb @amery
Squashed arm/CMA support
5c5ffa5 
commit ee1e5e7eda9d875967cd668acd8e24c68b4266ba
Merge: 2bbc8e6 2aee149
Author: Siarhei Siamashka <[email protected]>
Date:   Wed Dec 25 03:22:16 2013 +0200

    Merge branch 'v3.4.46-ltsi-cma' into stage/sunxi-3.4

    This is a merge of CMA patches from LTSI:
        http://ltsi.linuxfoundation.org/releases/ltsi-tree/3.4.46-ltsi/stable-release

    Conflicts:
    	arch/arm/mm/mmu.c
    	drivers/base/Kconfig
    	mm/page_alloc.c

commit 2aee14906cf931ca542fff2157107d1a7621f20c
Author: Sachin Kamat <[email protected]>
Date:   Mon Oct 29 16:51:15 2012 +0900

    ARM: dma-mapping: Fix potential memory leak in atomic_pool_init()

    When either of __alloc_from_contiguous or __alloc_remap_buffer fails
    to provide a valid pointer, allocated memory is freed up and an error
    is returned. 'pages' was however not freed before returning error.

    Cc: Arnd Bergmann <[email protected]>
    Cc: Marek Szyprowski <[email protected]>
    Signed-off-by: Sachin Kamat <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit ec10665cbf271fb1f60daeb194ad4f2cdcdc59d9)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit e7086478542d07eda0017258eb5137a050f15b08
Author: Hiroshi Doyu <[email protected]>
Date:   Mon Oct 29 16:51:14 2012 +0900

    ARM: dma-mapping: atomic_pool with struct page **pages

    struct page **pages is necessary to align with non atomic path in
    __iommu_get_pages(). atomic_pool() has the intialized **pages instead
    of just *page.

    Signed-off-by: Hiroshi Doyu <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 6b3fe47264262fa082897ebe8ae01041eae65e14)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit e4a9d193c2501ecc66307eae49e2f8826556e712
Author: Thomas Petazzoni <[email protected]>
Date:   Mon Oct 29 16:51:13 2012 +0900

    arm: mm: fix DMA pool affiliation check

    The __free_from_pool() function was changed in
    e9da6e9905e639b0f842a244bc770b48ad0523e9. Unfortunately, the test that
    checks whether the provided (start,size) is within the DMA pool has
    been improperly modified. It used to be:

      if (start < coherent_head.vm_start || end > coherent_head.vm_end)

    Where coherent_head.vm_end was non-inclusive (i.e, it did not include
    the first byte after the pool). The test has been changed to:

      if (start < pool->vaddr || start > pool->vaddr + pool->size)

    So now pool->vaddr + pool->size is inclusive (i.e, it includes the
    first byte after the pool), so the test should be >= instead of >.

    This bug causes the following message when freeing the *first* DMA
    coherent buffer that has been allocated, because its virtual address
    is exactly equal to pool->vaddr + pool->size :

    WARNING: at /home/thomas/projets/linux-2.6/arch/arm/mm/dma-mapping.c:463 __free_from_pool+0xa4/0xc0()
    freeing wrong coherent size from pool

    Signed-off-by: Thomas Petazzoni <[email protected]>
    Cc: Marek Szyprowski <[email protected]>
    Cc: Russell King <[email protected]>
    Cc: Lior Amsalem <[email protected]>
    Cc: Maen Suleiman <[email protected]>
    Cc: Tawfik Bayouk <[email protected]>
    Cc: Shadi Ammouri <[email protected]>
    Cc: Eran Ben-Avi <[email protected]>
    Cc: Yehuda Yitschak <[email protected]>
    Cc: Nadav Haklai <[email protected]>
    [m.szyprowski: rebased onto v3.6-rc5 and resolved conflict]
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit f3d87524975f01b885fc3d009c6ab6afd0d00746)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit 00d276cb10360235df524a3573ccf09b8810dbc1
Author: Hiroshi Doyu <[email protected]>
Date:   Mon Oct 29 16:51:12 2012 +0900

    ARM: dma-mapping: Refactor out to introduce __in_atomic_pool

    Check the given range("start", "size") is included in "atomic_pool" or not.

    Signed-off-by: Hiroshi Doyu <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 21d0a75951ccf71f671eb24b61a8ad2b497be4b4)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit 9c0f200b6f590fc4d998bc224714ed21d73b68c3
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:51:11 2012 +0900

    ARM: DMA-Mapping: print warning when atomic coherent allocation fails

    Print a loud warning when system runs out of memory from atomic DMA
    coherent pool to let users notice the potential problem.

    Reported-by: Aaro Koskinen <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit fb71285f0c1633a85544784aae7577502274b77a)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit 6aa629fe5cec4b2bf7735c7340e7c3ae11083b02
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:51:10 2012 +0900

    ARM: DMA-Mapping: add function for setting coherent pool size from platform code

    Some platforms might require to increase atomic coherent pool to make
    sure that their device will be able to allocate all their buffers from
    atomic context. This function can be also used to decrease atomic
    coherent pool size if coherent allocations are not used for the given
    sub-platform.

    Suggested-by: Josh Coombs <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 6e5267aa543817015edb4a65c66e15f9809f92bd)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit c3389701658cbc49db34efb345dc3361cf09e0b3
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:51:09 2012 +0900

    mm: cma: fix alignment requirements for contiguous regions

    Contiguous Memory Allocator requires each of its regions to be aligned
    in such a way that it is possible to change migration type for all
    pageblocks holding it and then isolate page of largest possible order from
    the buddy allocator (which is MAX_ORDER-1). This patch relaxes alignment
    requirements by one order, because MAX_ORDER alignment is not really
    needed.

    Signed-off-by: Marek Szyprowski <[email protected]>
    CC: Michal Nazarewicz <[email protected]>
    Acked-by: Michal Nazarewicz <[email protected]>
    (cherry picked from commit 7ce9bf1f4785dab0598a19a7fcb0733a18193e4e)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit 82fe63726f86dede0037e5c2d188930128ede637
Author: Aaro Koskinen <[email protected]>
Date:   Mon Oct 29 16:51:08 2012 +0900

    ARM: dma-mapping: fix incorrect freeing of atomic allocations

    Commit e9da6e9905e639b0f842a244bc770b48ad0523e9 (ARM: dma-mapping:
    remove custom consistent dma region) changed the way atomic allocations
    are handled. However, arm_dma_free() was not modified accordingly, and
    as a result freeing of atomic allocations does not work correctly when
    CMA is disabled. Memory is leaked and following WARNINGs are seen:

    [   57.698911] ------------[ cut here ]------------
    [   57.753518] WARNING: at arch/arm/mm/dma-mapping.c:263 arm_dma_free+0x88/0xe4()
    [   57.811473] trying to free invalid coherent area: e0848000
    [   57.867398] Modules linked in: sata_mv(-)
    [   57.921373] [<c000d270>] (unwind_backtrace+0x0/0xf0) from [<c0015430>] (warn_slowpath_common+0x50/0x68)
    [   58.033924] [<c0015430>] (warn_slowpath_common+0x50/0x68) from [<c00154dc>] (warn_slowpath_fmt+0x30/0x40)
    [   58.152024] [<c00154dc>] (warn_slowpath_fmt+0x30/0x40) from [<c000dc18>] (arm_dma_free+0x88/0xe4)
    [   58.219592] [<c000dc18>] (arm_dma_free+0x88/0xe4) from [<c008fa30>] (dma_pool_destroy+0x100/0x148)
    [   58.345526] [<c008fa30>] (dma_pool_destroy+0x100/0x148) from [<c019a64c>] (release_nodes+0x144/0x218)
    [   58.475782] [<c019a64c>] (release_nodes+0x144/0x218) from [<c0197e10>] (__device_release_driver+0x60/0xb8)
    [   58.614260] [<c0197e10>] (__device_release_driver+0x60/0xb8) from [<c0198608>] (driver_detach+0xd8/0xec)
    [   58.756527] [<c0198608>] (driver_detach+0xd8/0xec) from [<c0197c54>] (bus_remove_driver+0x7c/0xc4)
    [   58.901648] [<c0197c54>] (bus_remove_driver+0x7c/0xc4) from [<c004bfac>] (sys_delete_module+0x19c/0x220)
    [   59.051447] [<c004bfac>] (sys_delete_module+0x19c/0x220) from [<c0009140>] (ret_fast_syscall+0x0/0x2c)
    [   59.207996] ---[ end trace 0745420412c0325a ]---
    [   59.287110] ------------[ cut here ]------------
    [   59.366324] WARNING: at arch/arm/mm/dma-mapping.c:263 arm_dma_free+0x88/0xe4()
    [   59.450511] trying to free invalid coherent area: e0847000
    [   59.534357] Modules linked in: sata_mv(-)
    [   59.616785] [<c000d270>] (unwind_backtrace+0x0/0xf0) from [<c0015430>] (warn_slowpath_common+0x50/0x68)
    [   59.790030] [<c0015430>] (warn_slowpath_common+0x50/0x68) from [<c00154dc>] (warn_slowpath_fmt+0x30/0x40)
    [   59.972322] [<c00154dc>] (warn_slowpath_fmt+0x30/0x40) from [<c000dc18>] (arm_dma_free+0x88/0xe4)
    [   60.070701] [<c000dc18>] (arm_dma_free+0x88/0xe4) from [<c008fa30>] (dma_pool_destroy+0x100/0x148)
    [   60.256817] [<c008fa30>] (dma_pool_destroy+0x100/0x148) from [<c019a64c>] (release_nodes+0x144/0x218)
    [   60.445201] [<c019a64c>] (release_nodes+0x144/0x218) from [<c0197e10>] (__device_release_driver+0x60/0xb8)
    [   60.634148] [<c0197e10>] (__device_release_driver+0x60/0xb8) from [<c0198608>] (driver_detach+0xd8/0xec)
    [   60.823623] [<c0198608>] (driver_detach+0xd8/0xec) from [<c0197c54>] (bus_remove_driver+0x7c/0xc4)
    [   61.013268] [<c0197c54>] (bus_remove_driver+0x7c/0xc4) from [<c004bfac>] (sys_delete_module+0x19c/0x220)
    [   61.203472] [<c004bfac>] (sys_delete_module+0x19c/0x220) from [<c0009140>] (ret_fast_syscall+0x0/0x2c)
    [   61.393390] ---[ end trace 0745420412c0325b ]---

    The patch fixes this.

    Signed-off-by: Aaro Koskinen <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit d9e0d149b5dcc2ef4688afc572b9906bcda941ef)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit bb2718c695c0aa15cd0fd9a4847ff67937cd4c56
Author: Aaro Koskinen <[email protected]>
Date:   Mon Oct 29 16:51:07 2012 +0900

    ARM: dma-mapping: fix atomic allocation alignment

    The alignment mask is calculated incorrectly. Fixing the calculation
    makes strange hangs/lockups disappear during the boot with Amstrad E3
    and 3.6-rc1 kernel.

    Signed-off-by: Aaro Koskinen <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit e4ea6918c93b9f59d34e8ca2124b2b64b1afe73b)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit 57861a305627c98801780014e4f7782dee3c5714
Author: Russell King <[email protected]>
Date:   Mon Oct 29 16:51:06 2012 +0900

    ARM: fix warning caused by wrongly typed arm_dma_limit

    arch/arm/mm/init.c: In function 'arm_memblock_init':
    arch/arm/mm/init.c:380: warning: comparison of distinct pointer types lacks a cast

    by fixing the typecast in its definition when DMA_ZONE is disabled.
    This was missed in 4986e5c7c (ARM: mm: fix type of the arm_dma_limit
    global variable).

    Signed-off-by: Russell King <[email protected]>
    (cherry picked from commit 09b2ad13da3ac7c717dd86bfca7072d9b36f7449)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit e7fc0512ee0dc45d8df8a59f5a9b54169596db7f
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:51:05 2012 +0900

    ARM: dma-mapping: fix buffer chunk allocation order

    IOMMU-aware dma_alloc_attrs() implementation allocates buffers in
    power-of-two chunks to improve performance and take advantage of large
    page mappings provided by some IOMMU hardware. However current code, due
    to a subtle bug, allocated those chunks in the smallest-to-largest
    order, what completely killed all the advantages of using larger than
    page chunks. If a 4KiB chunk has been mapped as a first chunk, the
    consecutive chunks are not aligned correctly to the power-of-two which
    match their size and IOMMU drivers were not able to use internal
    mappings of size other than the 4KiB (largest common denominator of
    alignment and chunk size).

    This patch fixes this issue by changing to the correct largest-to-smallest
    chunk size allocation sequence.

    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 593f47355467b9ef44293698817e2bdb347e2d11)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit ec7459b02995094ef0d01037b80b0ba7c9fbb7c6
Author: Randy Dunlap <[email protected]>
Date:   Mon Oct 29 16:51:04 2012 +0900

    driver core: fix some kernel-doc warnings in dma*.c

    Fix kernel-doc warnings in drivers/base/dma*.c:

    Warning(drivers/base/dma-buf.c:498): No description found for parameter 'vaddr'
    Warning(drivers/base/dma-coherent.c:199): No description found for parameter 'ret'

    Signed-off-by: Randy Dunlap <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    (cherry picked from commit 6e7b4a59b3d7bb2dcd11c019354bf0c91037dadd)

    Conflicts:

    	drivers/base/dma-buf.c

    Backported patch only addresses dma-coherent.c warning, as dma-buf.c warning is
    not present in 3.4 kernel.

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit 4f02add73d3ec9e814cc53b10fea42513ab71f22
Author: Minchan Kim <[email protected]>
Date:   Mon Oct 29 16:51:03 2012 +0900

    mm: factor out memory isolate functions

    mm/page_alloc.c has some memory isolation functions but they are used only
    when we enable CONFIG_{CMA|MEMORY_HOTPLUG|MEMORY_FAILURE}.  So let's make
    it configurable by new CONFIG_MEMORY_ISOLATION so that it can reduce
    binary size and we can check it simple by CONFIG_MEMORY_ISOLATION, not if
    defined CONFIG_{CMA|MEMORY_HOTPLUG|MEMORY_FAILURE}.

    Signed-off-by: Minchan Kim <[email protected]>
    Cc: Andi Kleen <[email protected]>
    Cc: Marek Szyprowski <[email protected]>
    Acked-by: KAMEZAWA Hiroyuki <[email protected]>
    Cc: KOSAKI Motohiro <[email protected]>
    Cc: Mel Gorman <[email protected]>
    Cc: Michal Hocko <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Linus Torvalds <[email protected]>
    (cherry picked from commit ee6f509c3274014d1f52e7a7a10aee9f85393c5e)

    Conflicts:

    	mm/Makefile

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit 63d767819e6fcf472f9535d1b4628913ddcc5d64
Author: Minchan Kim <[email protected]>
Date:   Mon Oct 29 16:51:02 2012 +0900

    mm: clean up __count_immobile_pages()

    The __count_immobile_pages() naming is rather awkward.  Choose a more
    clear name and add a comment.

    Signed-off-by: Minchan Kim <[email protected]>
    Cc: Andrea Arcangeli <[email protected]>
    Cc: Mel Gorman <[email protected]>
    Cc: Michal Hocko <[email protected]>
    Acked-by: KAMEZAWA Hiroyuki <[email protected]>
    Cc: Bartlomiej Zolnierkiewicz <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Linus Torvalds <[email protected]>
    (cherry picked from commit 80934513b230bfcf70265f2ef0fdae89fb391633)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit 21086e13604d5a72a8cd75a6062b55762317b748
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:51:01 2012 +0900

    common: dma-mapping: add support for generic dma_mmap_* calls

    Commit 9adc5374 ('common: dma-mapping: introduce mmap method') added a
    generic method for implementing mmap user call to dma_map_ops structure.

    This patch converts ARM and PowerPC architectures (the only providers of
    dma_mmap_coherent/dma_mmap_writecombine calls) to use this generic
    dma_map_ops based call and adds a generic cross architecture
    definition for dma_mmap_attrs, dma_mmap_coherent, dma_mmap_writecombine
    functions.

    The generic mmap virt_to_page-based fallback implementation is provided for
    architectures which don't provide their own implementation for mmap method.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Reviewed-by: Kyungmin Park <[email protected]>
    (cherry picked from commit 64ccc9c033c6089b2d426dad3c56477ab066c999)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit e6877b7aaa30541e2f2601032f48c8216076eac6
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:51:00 2012 +0900

    ARM: dma-mapping: fix error path for memory allocation failure

    This patch fixes incorrect check in error path. When the allocation of
    first page fails, the kernel ops appears due to accessing -1 element of
    the pages array.

    Reported-by: Sylwester Nawrocki <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 9fa8af91f0679f2abbebe1382b937264f3a8b981)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit e49dcb5b0ae74c85aca81d33aad8f3b8e8bcdad1
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:59 2012 +0900

    ARM: dma-mapping: add more sanity checks in arm_dma_mmap()

    Add some sanity checks and forbid mmaping of buffers into vma areas larger
    than allocated dma buffer.

    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 50262a4bf38dd70486e9fce2b8235d5ae3e0f627)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit a683c6762033c9c40292fc00813e8f51d0630945
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:58 2012 +0900

    ARM: dma-mapping: remove custom consistent dma region

    This patch changes dma-mapping subsystem to use generic vmalloc areas
    for all consistent dma allocations. This increases the total size limit
    of the consistent allocations and removes platform hacks and a lot of
    duplicated code.

    Atomic allocations are served from special pool preallocated on boot,
    because vmalloc areas cannot be reliably created in atomic context.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Reviewed-by: Kyungmin Park <[email protected]>
    Reviewed-by: Minchan Kim <[email protected]>
    (cherry picked from commit e9da6e9905e639b0f842a244bc770b48ad0523e9)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit 8a7d1dd986d8a25885b8d50b53f1c71d2d6130b3
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:57 2012 +0900

    mm: vmalloc: use const void * for caller argument

    'const void *' is a safer type for caller function type. This patch
    updates all references to caller function type.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Reviewed-by: Kyungmin Park <[email protected]>
    Reviewed-by: Minchan Kim <[email protected]>
    (cherry picked from commit 5e6cafc83e30f0f70c79a2b7aef237dc57e29f02)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>

commit f056881b91c8b256cc9d2e16b99ba520782ec0bc
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:56 2012 +0900

    ARM: relax conditions required for enabling Contiguous Memory Allocator

    Contiguous Memory Allocator requires only paging and MMU enabled not
    particular CPU architectures, so there is no need for strict dependency
    on CPU type. This enables to use CMA on some older ARM v5 systems which
    also might need large contiguous blocks for the multimedia processing hw
    modules.

    Reported-by: Prabhakar Lad <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Tested-by: Prabhakar Lad <[email protected]>
    (cherry picked from commit e092705bcd53de3bafc3053b0b55bf83e5d6711f)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 65ffaed254e6c2d6d37a99313b06b3dcdc8de611
Author: Chris Brand <[email protected]>
Date:   Mon Oct 29 16:50:55 2012 +0900

    ARM: mm: fix MMU mapping of CMA regions

    Fix dma_contiguous_remap() so that it continues through all the
    regions, even after encountering one that is outside lowmem.
    Without this change, if you have two CMA regions, the first outside
    lowmem and the seocnd inside lowmem, only the second one will get
    set up in the MMU. Data written to that region then doesn't get
    automatically flushed from the cache into memory.

    Signed-off-by: Chris Brand <[email protected]>
    [extended patch subject with 'fix' word]
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 39f78e70567a07a6fc0d7a4ca9e3331e44dd400d)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 0399c3b81c049913debe2bef12b53b961a6e46a9
Author: Prathyush K <[email protected]>
Date:   Mon Oct 29 16:50:54 2012 +0900

    ARM: dma-mapping: modify condition check while freeing pages

    WARNING: at mm/vmalloc.c:1471 __iommu_free_buffer+0xcc/0xd0()
    Trying to vfree() nonexistent vm area (ef095000)
    Modules linked in:
    [<c0015a18>] (unwind_backtrace+0x0/0xfc) from [<c0025a94>] (warn_slowpath_common+0x54/0x64)
    [<c0025a94>] (warn_slowpath_common+0x54/0x64) from [<c0025b38>] (warn_slowpath_fmt+0x30/0x40)
    [<c0025b38>] (warn_slowpath_fmt+0x30/0x40) from [<c0016de0>] (__iommu_free_buffer+0xcc/0xd0)
    [<c0016de0>] (__iommu_free_buffer+0xcc/0xd0) from [<c0229a5c>] (exynos_drm_free_buf+0xe4/0x138)
    [<c0229a5c>] (exynos_drm_free_buf+0xe4/0x138) from [<c022b358>] (exynos_drm_gem_destroy+0x80/0xfc)
    [<c022b358>] (exynos_drm_gem_destroy+0x80/0xfc) from [<c0211230>] (drm_gem_object_free+0x28/0x34)
    [<c0211230>] (drm_gem_object_free+0x28/0x34) from [<c0211bd0>] (drm_gem_object_release_handle+0xcc/0xd8)
    [<c0211bd0>] (drm_gem_object_release_handle+0xcc/0xd8) from [<c01abe10>] (idr_for_each+0x74/0xb8)
    [<c01abe10>] (idr_for_each+0x74/0xb8) from [<c02114e4>] (drm_gem_release+0x1c/0x30)
    [<c02114e4>] (drm_gem_release+0x1c/0x30) from [<c0210ae8>] (drm_release+0x608/0x694)
    [<c0210ae8>] (drm_release+0x608/0x694) from [<c00b75a0>] (fput+0xb8/0x228)
    [<c00b75a0>] (fput+0xb8/0x228) from [<c00b40c4>] (filp_close+0x64/0x84)
    [<c00b40c4>] (filp_close+0x64/0x84) from [<c0029d54>] (put_files_struct+0xe8/0x104)
    [<c0029d54>] (put_files_struct+0xe8/0x104) from [<c002b930>] (do_exit+0x608/0x774)
    [<c002b930>] (do_exit+0x608/0x774) from [<c002bae4>] (do_group_exit+0x48/0xb4)
    [<c002bae4>] (do_group_exit+0x48/0xb4) from [<c002bb60>] (sys_exit_group+0x10/0x18)
    [<c002bb60>] (sys_exit_group+0x10/0x18) from [<c000ee80>] (ret_fast_syscall+0x0/0x30)

    This patch modifies the condition while freeing to match the condition
    used while allocation. This fixes the above warning which arises when
    array size is equal to PAGE_SIZE where allocation is done using kzalloc
    but free is done using vfree.

    Signed-off-by: Prathyush K <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 46c87852e99cf8ce97e207b11cde19085837e39c)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit e26a2e078e5483a54b9531868c1d18177b6382b8
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:53 2012 +0900

    mm: cma: fix condition check when setting global cma area

    dev_set_cma_area incorrectly assigned cma to global area on first call
    due to incorrect check. This patch fixes this issue.

    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit cc2caea5b6152b8ce66dc2bbe83dc72b60612da8)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 037af057ec4b8dc147ecce464e6cbb3be92510fd
Author: Rabin Vincent <[email protected]>
Date:   Mon Oct 29 16:50:52 2012 +0900

    mm: cma: don't replace lowmem pages with highmem

    The filesystem layer expects pages in the block device's mapping to not
    be in highmem (the mapping's gfp mask is set in bdget()), but CMA can
    currently replace lowmem pages with highmem pages, leading to crashes in
    filesystem code such as the one below:

      Unable to handle kernel NULL pointer dereference at virtual address 00000400
      pgd = c0c98000
      [00000400] *pgd=00c91831, *pte=00000000, *ppte=00000000
      Internal error: Oops: 817 [#1] PREEMPT SMP ARM
      CPU: 0    Not tainted  (3.5.0-rc5+ #80)
      PC is at __memzero+0x24/0x80
      ...
      Process fsstress (pid: 323, stack limit = 0xc0cbc2f0)
      Backtrace:
      [<c010e3f0>] (ext4_getblk+0x0/0x180) from [<c010e58c>] (ext4_bread+0x1c/0x98)
      [<c010e570>] (ext4_bread+0x0/0x98) from [<c0117944>] (ext4_mkdir+0x160/0x3bc)
       r4:c15337f0
      [<c01177e4>] (ext4_mkdir+0x0/0x3bc) from [<c00c29e0>] (vfs_mkdir+0x8c/0x98)
      [<c00c2954>] (vfs_mkdir+0x0/0x98) from [<c00c2a60>] (sys_mkdirat+0x74/0xac)
       r6:00000000 r5:c152eb40 r4:000001ff r3:c14b43f0
      [<c00c29ec>] (sys_mkdirat+0x0/0xac) from [<c00c2ab8>] (sys_mkdir+0x20/0x24)
       r6:beccdcf0 r5:00074000 r4:beccdbbc
      [<c00c2a98>] (sys_mkdir+0x0/0x24) from [<c000e3c0>] (ret_fast_syscall+0x0/0x30)

    Fix this by replacing only highmem pages with highmem.

    Reported-by: Laura Abbott <[email protected]>
    Signed-off-by: Rabin Vincent <[email protected]>
    Acked-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 6a6dccba2fdc2a69f1f36b8f1c0acc8598e7221b)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 56792e85bc2f8c14c4f64f46fde3afb4fd10cd61
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:51 2012 +0900

    x86: dma-mapping: fix broken allocation when dma_mask has been provided

    Commit 0a2b9a6ea93 ("X86: integrate CMA with DMA-mapping subsystem")
    broke memory allocation with dma_mask. This patch fixes possible kernel
    ops caused by lack of resetting page variable when jumping to 'again' label.

    Reported-by: Konrad Rzeszutek Wilk <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Michal Nazarewicz <[email protected]>
    (cherry picked from commit c080e26edc3a2a3cdfa4c430c663ee1c3bbd8fae)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 136dac72225ac4399522b8a42b29bb39c2e94b97
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:50 2012 +0900

    ARM: dma-mapping: fix debug messages in dmabounce code

    This patch fixes the usage of uninitialized variables in dmabounce code
    intoduced by commit a227fb92 ('ARM: dma-mapping: remove offset parameter
    to prepare for generic dma_ops'):
    arch/arm/common/dmabounce.c: In function ‘dmabounce_sync_for_device’:
    arch/arm/common/dmabounce.c:409: warning: ‘off’ may be used uninitialized in this function
    arch/arm/common/dmabounce.c:407: note: ‘off’ was declared here
    arch/arm/common/dmabounce.c: In function ‘dmabounce_sync_for_cpu’:
    arch/arm/common/dmabounce.c:369: warning: ‘off’ may be used uninitialized in this function
    arch/arm/common/dmabounce.c:367: note: ‘off’ was declared here

    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit fdb1117325ad719dc39e81209bc622d511db70e0)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 825d00daacd8c2ee76e297c9ce0dfc17d8a2bb85
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:49 2012 +0900

    ARM: mm: fix type of the arm_dma_limit global variable

    arm_dma_limit stores physical address of maximal address accessible by DMA,
    so the phys_addr_t type makes much more sense for it instead of u32. This
    patch fixes the following build warning:

    arch/arm/mm/init.c:380: warning: comparison of distinct pointer types lacks a cast

    Reported-by: Russell King <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 4986e5c7cd91817d0f58dd15073c9080d47980cf)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 5d6075133b365ae6a34dba6c0a108445d99e4a3c
Author: Sachin Kamat <[email protected]>
Date:   Mon Oct 29 16:50:48 2012 +0900

    ARM: dma-mapping: Add missing static storage class specifier

    Fixes the following sparse warnings:
    arch/arm/mm/dma-mapping.c:231:15: warning: symbol 'consistent_base' was not
    declared. Should it be static?
    arch/arm/mm/dma-mapping.c:326:8: warning: symbol 'coherent_pool_size' was not
    declared. Should it be static?

    Signed-off-by: Sachin Kamat <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit e53f517ff236a0ec5413ff3935c53406b69bc1e2)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit b53b5181a0d2683f2f5de207136410e785eff85c
Author: Ohad Ben-Cohen <[email protected]>
Date:   Mon Oct 29 16:50:47 2012 +0900

    iommu/core: pass a user-provided token to fault handlers

    Sometimes a single IOMMU user may have to deal with several
    different IOMMU devices (e.g. remoteproc).

    When an IOMMU fault happens, such users have to regain their
    context in order to deal with the fault.

    Users can't use the private fields of neither the iommu_domain nor
    the IOMMU device, because those are already used by the IOMMU core
    and low level driver (respectively).

    This patch just simply allows users to pass a private token (most
    notably their own context pointer) to iommu_set_fault_handler(),
    and then makes sure it is provided back to the users whenever
    an IOMMU fault happens.

    The patch also adopts remoteproc to the new fault handling
    interface, but the real functionality using this (recovery of
    remote processors) will only be added later in a subsequent patch
    set.

    Cc: Fernando Guzman Lugo <[email protected]>
    Signed-off-by: Ohad Ben-Cohen <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>
    (cherry picked from commit 77ca23323594589ac8cba1c8d59bfe7e85d3cb8b)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 95f907b4158975160624b86ea7575298148c51db
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:46 2012 +0900

    ARM: dma-mapping: remove unconditional dependency on CMA

    CMA has been enabled unconditionally on all ARMv6+ systems to solve the
    long standing issue of double kernel mappings for all dma coherent
    buffers. This however created a dependency on CONFIG_EXPERIMENTAL for
    the whole ARM architecture what should be really avoided. This patch
    removes this dependency and lets one use old, well-tested dma-mapping
    implementation also on ARMv6+ systems without the need to use
    EXPERIMENTAL stuff.

    Reported-by: Russell King <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit f1ae98da8525c6b8b1c301c3a2b0bd2b6515cca2)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 53195e721e0e6106325417acd91d274095d210b1
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:45 2012 +0900

    ARM: dma-mapping: add support for IOMMU mapper

    This patch add a complete implementation of DMA-mapping API for
    devices which have IOMMU support.

    This implementation tries to optimize dma address space usage by remapping
    all possible physical memory chunks into a single dma address space chunk.

    DMA address space is managed on top of the bitmap stored in the
    dma_iommu_mapping structure stored in device->archdata. Platform setup
    code has to initialize parameters of the dma address space (base address,
    size, allocation precision order) with arm_iommu_create_mapping() function.
    To reduce the size of the bitmap, all allocations are aligned to the
    specified order of base 4 KiB pages.

    dma_alloc_* functions allocate physical memory in chunks, each with
    alloc_pages() function to avoid failing if the physical memory gets
    fragmented. In worst case the allocated buffer is composed of 4 KiB page
    chunks.

    dma_map_sg() function minimizes the total number of dma address space
    chunks by merging of physical memory chunks into one larger dma address
    space chunk. If requested chunk (scatter list entry) boundaries
    match physical page boundaries, most calls to dma_map_sg() requests will
    result in creating only one chunk in dma address space.

    dma_map_page() simply creates a mapping for the given page(s) in the dma
    address space.

    All dma functions also perform required cache operation like their
    counterparts from the arm linear physical memory mapping version.

    This patch contains code and fixes kindly provided by:
    - Krishna Reddy <[email protected]>,
    - Andrzej Pietrasiewicz <[email protected]>,
    - Hiroshi DOYU <[email protected]>

    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Reviewed-by: Konrad Rzeszutek Wilk <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit 4ce63fcd919c32d22528e54dcd89506962933719)

    Conflicts:

            arch/arm/mm/dma-mapping.c

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit dba04c0f43513f07d3d4e7f5869111e92e885c37
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:44 2012 +0900

    ARM: dma-mapping: use alloc, mmap, free from dma_ops

    This patch converts dma_alloc/free/mmap_{coherent,writecombine}
    functions to use generic alloc/free/mmap methods from dma_map_ops
    structure. A new DMA_ATTR_WRITE_COMBINE DMA attribute have been
    introduced to implement writecombine methods.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Acked-by: Arnd Bergmann <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit f99d60341238fe73fc514129cd9ae4e44e1b2c47)

    Conflicts:

    	arch/arm/mm/dma-mapping.c

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 242efb8681142625d1776c0d2a8d257e98b10eee
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:43 2012 +0900

    ARM: dma-mapping: remove redundant code and do the cleanup

    This patch just performs a global cleanup in DMA mapping implementation
    for ARM architecture. Some of the tiny helper functions have been moved
    to the caller code, some have been merged together.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Acked-by: Arnd Bergmann <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit 51fde3499b531d4cf278f4d2eaa6c45b2865b16b)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 099faed3a8826eb7d3b7adc795cdcc19b52e9c70
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:42 2012 +0900

    ARM: dma-mapping: move all dma bounce code to separate dma ops structure

    This patch removes dma bounce hooks from the common dma mapping
    implementation on ARM architecture and creates a separate set of
    dma_map_ops for dma bounce devices.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit 15237e1f505b3e5c2276f240b01cd2133e110cbc)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit ae47af4cf52b478f5e37d4aa4ed0bd7ff50f8a07
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:41 2012 +0900

    ARM: dma-mapping: implement dma sg methods on top of any generic dma ops

    This patch converts all dma_sg methods to be generic (independent of the
    current DMA mapping implementation for ARM architecture). All dma sg
    operations are now implemented on top of respective
    dma_map_page/dma_sync_single_for* operations from dma_map_ops structure.

    Before this patch there were custom methods for all scatter/gather
    related operations. They iterated over the whole scatter list and called
    cache related operations directly (which in turn checked if we use dma
    bounce code or not and called respective version). This patch changes
    them not to use such shortcut. Instead it provides similar loop over
    scatter list and calls methods from the device's dma_map_ops structure.
    This enables us to use device dependent implementations of cache related
    operations (direct linear or dma bounce) depending on the provided
    dma_map_ops structure.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit 2a550e73d3e5f040a3e8eb733c942ab352eafb36)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 3eda90191d76d3fe2cb2a09bb8ce03b686b61d38
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:40 2012 +0900

    ARM: dma-mapping: use asm-generic/dma-mapping-common.h

    This patch modifies dma-mapping implementation on ARM architecture to
    use common dma_map_ops structure and asm-generic/dma-mapping-common.h
    helpers.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit 2dc6a016bbedf18f18ad73997e5338307d6dbde9)

    Conflicts:

    	arch/arm/Kconfig

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 93bb1a72f475b0cd7422fcfd9a130210ab32a6a5
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:39 2012 +0900

    ARM: dma-mapping: remove offset parameter to prepare for generic dma_ops

    This patch removes the need for the offset parameter in dma bounce
    functions. This is required to let dma-mapping framework on ARM
    architecture to use common, generic dma_map_ops based dma-mapping
    helpers.

    Background and more detailed explaination:

    dma_*_range_* functions are available from the early days of the dma
    mapping api. They are the correct way of doing a partial syncs on the
    buffer (usually used by the network device drivers). This patch changes
    only the internal implementation of the dma bounce functions to let
    them tunnel through dma_map_ops structure. The driver api stays
    unchanged, so driver are obliged to call dma_*_range_* functions to
    keep code clean and easy to understand.

    The only drawback from this patch is reduced detection of the dma api
    abuse. Let us consider the following code:

    dma_addr = dma_map_single(dev, ptr, 64, DMA_TO_DEVICE);
    dma_sync_single_range_for_cpu(dev, dma_addr+16, 0, 32, DMA_TO_DEVICE);

    Without the patch such code fails, because dma bounce code is unable
    to find the bounce buffer for the given dma_address. After the patch
    the above sync call will be equivalent to:

    dma_sync_single_range_for_cpu(dev, dma_addr, 16, 32, DMA_TO_DEVICE);

    which succeeds.

    I don't consider this as a real problem, because DMA API abuse should be
    caught by debug_dma_* function family. This patch lets us to simplify
    the internal low-level implementation without chaning the driver visible
    API.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit a227fb92a0f5f0dd8282719386e9b3a29f0d16b2)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 79a80f4e467558717c6ac76302a31e0c69af738a
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:38 2012 +0900

    ARM: dma-mapping: introduce DMA_ERROR_CODE constant

    Replace all uses of ~0 with DMA_ERROR_CODE, what should make the code
    easier to read.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit 553ac78877242b6d8b591323731df304140d0f99)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit b8aca1f7638ae019015546e91b0a741200cd0236
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:37 2012 +0900

    ARM: dma-mapping: use pr_* instread of printk

    Replace all calls to printk with pr_* functions family.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Acked-by: Arnd Bergmann <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit 6b6f770b573903f8a7d1cfab1fc662685653f413)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 6632fab348a3322f9324b41d0733272eb5d39f16
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:36 2012 +0900

    ARM: dma-mapping: use dma_mmap_from_coherent()

    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 47142f07eea32e9c108f548a4b06c28bec7df6e4)

    Conflicts:

    	arch/arm/mm/dma-mapping.c

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 67527009619d1015b075a53502cb184db483c655
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:35 2012 +0900

    common: add dma_mmap_from_coherent() function

    Add a common helper for dma-mapping core for mapping a coherent buffer
    to userspace.

    Reported-by: Subash Patel <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Kyungmin Park <[email protected]>
    Tested-By: Subash Patel <[email protected]>
    (cherry picked from commit bca0fa5f12a6744a2b2e53154af65a51402b3426)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 5428b0199de7881667896f6ef126c4887af4a2c3
Author: Vitaly Andrianov <[email protected]>
Date:   Mon Oct 29 16:50:34 2012 +0900

    ARM: dma-mapping: use PMD size for section unmap

    The dma_contiguous_remap() function clears existing section maps using
    the wrong size (PGDIR_SIZE instead of PMD_SIZE).  This is a bug which
    does not affect non-LPAE systems, where PGDIR_SIZE and PMD_SIZE are the same.
    On LPAE systems, however, this bug causes the kernel to hang at this point.

    This fix has been tested on both LPAE and non-LPAE kernel builds.

    Signed-off-by: Vitaly Andrianov <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 61f6c7a47a2f84b7ba4b65240ffe9247df772b06)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 0245439393f82996f3cf4b8271cb1939fd8df951
Author: Minchan Kim <[email protected]>
Date:   Mon Oct 29 16:50:33 2012 +0900

    cma: fix migration mode

    __alloc_contig_migrate_range calls migrate_pages with wrong argument
    for migrate_mode. Fix it.

    Cc: Marek Szyprowski <[email protected]>
    Signed-off-by: Minchan Kim <[email protected]>
    Acked-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    (cherry picked from commit 58f42fd54144346898e6dc6d6ae3acd4c591b42f)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit f3655d25bcd287bfb62a1b202b1019c321900335
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:32 2012 +0900

    ARM: integrate CMA with DMA-mapping subsystem

    This patch adds support for CMA to dma-mapping subsystem for ARM
    architecture. By default a global CMA area is used, but specific devices
    are allowed to have their private memory areas if required (they can be
    created with dma_declare_contiguous() function during board
    initialisation).

    Contiguous memory areas reserved for DMA are remapped with 2-level page
    tables on boot. Once a buffer is requested, a low memory kernel mapping
    is updated to to match requested memory access type.

    GFP_ATOMIC allocations are performed from special pool which is created
    early during boot. This way remapping page attributes is not needed on
    allocation time.

    CMA has been enabled unconditionally for ARMv6+ systems.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Kyungmin Park <[email protected]>
    CC: Michal Nazarewicz <[email protected]>
    Acked-by: Arnd Bergmann <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit c79095092834a18ae74cfc08def1a5a101dc106c)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 0c66ce4969334b97079c4de068e7d2d812081681
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:31 2012 +0900

    X86: integrate CMA with DMA-mapping subsystem

    This patch adds support for CMA to dma-mapping subsystem for x86
    architecture that uses common pci-dma/pci-nommu implementation. This
    allows to test CMA on KVM/QEMU and a lot of common x86 boxes.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Kyungmin Park <[email protected]>
    CC: Michal Nazarewicz <[email protected]>
    Acked-by: Arnd Bergmann <[email protected]>
    (cherry picked from commit 0a2b9a6ea93650b8a00f9fd5ee8fdd25671e2df6)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 18c54c03865092e597897815ee0aadd69b8b3754
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:30 2012 +0900

    drivers: add Contiguous Memory Allocator

    The Contiguous Memory Allocator is a set of helper functions for DMA
    mapping framework that improves allocations of contiguous memory chunks.

    CMA grabs memory on system boot, marks it with MIGRATE_CMA migrate type
    and gives back to the system. Kernel is allowed to allocate only movable
    pages within CMA's managed memory so that it can be used for example for
    page cache when DMA mapping do not use it. On
    dma_alloc_from_contiguous() request such pages are migrated out of CMA
    area to free required contiguous block and fulfill the request. This
    allows to allocate large contiguous chunks of memory at any time
    assuming that there is enough free memory available in the system.

    This code is heavily based on earlier works by Michal Nazarewicz.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Kyungmin Park <[email protected]>
    Signed-off-by: Michal Nazarewicz <[email protected]>
    Acked-by: Arnd Bergmann <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit c64be2bb1c6eb43c838b2c6d57b074078be208dd)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 92b0e095dc5a0367c6be5e24842ce670d10367fa
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:29 2012 +0900

    mm: trigger page reclaim in alloc_contig_range() to stabilise watermarks

    alloc_contig_range() performs memory allocation so it also should keep
    track on keeping the correct level of memory watermarks. This commit adds
    a call to *_slowpath style reclaim to grab enough pages to make sure that
    the final collection of contiguous pages from freelists will not starve
    the system.

    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Kyungmin Park <[email protected]>
    CC: Michal Nazarewicz <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit 49f223a9cd96c7293d7258ff88c2bdf83065f69c)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 130d5a94aa9a38cb0c389a7b16614e31d6e91373
Author: Marek Szyprowski <[email protected]>
Date:   Mon Oct 29 16:50:28 2012 +0900

    mm: extract reclaim code from __alloc_pages_direct_reclaim()

    This patch extracts common reclaim code from __alloc_pages_direct_reclaim()
    function to separate function: __perform_reclaim() which can be later used
    by alloc_contig_range().

    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Kyungmin Park <[email protected]>
    Cc: Michal Nazarewicz <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit bba9071087108d3de70bea274e35064cc480487b)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 6f59300ba9e7e4dd1b46767ba8d705227a0e3df5
Author: Mel Gorman <[email protected]>
Date:   Mon Oct 29 16:50:27 2012 +0900

    mm: Serialize access to min_free_kbytes

    There is a race between the min_free_kbytes sysctl, memory hotplug
    and transparent hugepage support enablement.  Memory hotplug uses a
    zonelists_mutex to avoid a race when building zonelists. Reuse it to
    serialise watermark updates.

    [[email protected]: Older patch fixed the race with spinlock]
    Signed-off-by: Mel Gorman <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit cfd3da1e49bb95c355c01c0f502d657deb3d34a4)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 297403e910814abed263194dc6bce58a0bedb300
Author: Michal Nazarewicz <[email protected]>
Date:   Mon Oct 29 16:50:26 2012 +0900

    mm: page_isolation: MIGRATE_CMA isolation functions added

    This commit changes various functions that change pages and
    pageblocks migrate type between MIGRATE_ISOLATE and
    MIGRATE_MOVABLE in such a way as to allow to work with
    MIGRATE_CMA migrate type.

    Signed-off-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit 0815f3d81d76dfbf2abcfd93a85ff0a6008fe4c0)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 4b1c9f454608e87e1924226913b284dfd8cbffce
Author: Michal Nazarewicz <[email protected]>
Date:   Mon Oct 29 16:50:25 2012 +0900

    mm: mmzone: MIGRATE_CMA migration type added

    The MIGRATE_CMA migration type has two main characteristics:
    (i) only movable pages can be allocated from MIGRATE_CMA
    pageblocks and (ii) page allocator will never change migration
    type of MIGRATE_CMA pageblocks.

    This guarantees (to some degree) that page in a MIGRATE_CMA page
    block can always be migrated somewhere else (unless there's no
    memory left in the system).

    It is designed to be used for allocating big chunks (eg. 10MiB)
    of physically contiguous memory.  Once driver requests
    contiguous memory, pages from MIGRATE_CMA pageblocks may be
    migrated away to create a contiguous block.

    To minimise number of migrations, MIGRATE_CMA migration type
    is the last type tried when page allocator falls back to other
    migration types when requested.

    Signed-off-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Kyungmin Park <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit 47118af076f64844b4f423bc2f545b2da9dab50d)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit e3148a6a302d737cb0a469984a959d6e6432b8d1
Author: Michal Nazarewicz <[email protected]>
Date:   Mon Oct 29 16:50:24 2012 +0900

    mm: page_alloc: change fallbacks array handling

    This commit adds a row for MIGRATE_ISOLATE type to the fallbacks array
    which was missing from it.  It also, changes the array traversal logic
    a little making MIGRATE_RESERVE an end marker.  The letter change,
    removes the implicit MIGRATE_UNMOVABLE from the end of each row which
    was read by __rmqueue_fallback() function.

    Signed-off-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit 6d4a49160de2c684fb59fa627bce80e200224331)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 3254c033faf3461b6292463e31f852379da1f662
Author: Michal Nazarewicz <[email protected]>
Date:   Mon Oct 29 16:50:23 2012 +0900

    mm: page_alloc: introduce alloc_contig_range()

    This commit adds the alloc_contig_range() function which tries
    to allocate given range of pages.  It tries to migrate all
    already allocated pages that fall in the range thus freeing them.
    Once all pages in the range are freed they are removed from the
    buddy system thus allocated for the caller to use.

    Signed-off-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit 041d3a8cdc18dc375a128d90bbb753949a81b1fb)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 64dc481111efa88074521b73399c7aea1da58b0c
Author: Michal Nazarewicz <[email protected]>
Date:   Mon Oct 29 16:50:22 2012 +0900

    mm: compaction: export some of the functions

    This commit exports some of the functions from compaction.c file
    outside of it adding their declaration into internal.h header
    file so that other mm related code can use them.

    This forced compaction.c to always be compiled (as opposed to being
    compiled only if CONFIG_COMPACTION is defined) but as to avoid
    introducing code that user did not ask for, part of the compaction.c
    is now wrapped in on #ifdef.

    Signed-off-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit ff9543fd32060917beb080b1eb2d1d41ec7f39e0)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 4a9146950d6c41d522b06d9134d55ff06ea5a4c6
Author: Michal Nazarewicz <[email protected]>
Date:   Mon Oct 29 16:50:21 2012 +0900

    mm: compaction: introduce isolate_freepages_range()

    This commit introduces isolate_freepages_range() function which
    generalises isolate_freepages_block() so that it can be used on
    arbitrary PFN ranges.

    isolate_freepages_block() is left with only minor changes.

    Signed-off-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit 85aa125f001f87f96a72e9e6ee515490843b1202)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 200926c2bd77f1e240f648a28bb8cbc794c04d9e
Author: Michal Nazarewicz <[email protected]>
Date:   Mon Oct 29 16:50:20 2012 +0900

    mm: compaction: introduce map_pages()

    This commit creates a map_pages() function which map pages freed
    using split_free_pages().  This merely moves some code from
    isolate_freepages() so that it can be reused in other places.

    Signed-off-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit 03d44192f69a45d780ba124f691e76020a44ebae)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 7500c34c9b094308107176ccbc79e2104a972eb3
Author: Michal Nazarewicz <[email protected]>
Date:   Mon Oct 29 16:50:19 2012 +0900

    mm: compaction: introduce isolate_migratepages_range()

    This commit introduces isolate_migratepages_range() function which
    extracts functionality from isolate_migratepages() so that it can be
    used on arbitrary PFN ranges.

    isolate_migratepages() function is implemented as a simple wrapper
    around isolate_migratepages_range().

    Signed-off-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    Reviewed-by: KAMEZAWA Hiroyuki <[email protected]>
    Tested-by: Rob Clark <[email protected]>
    Tested-by: Ohad Ben-Cohen <[email protected]>
    Tested-by: Benjamin Gaignard <[email protected]>
    Tested-by: Robert Nelson <[email protected]>
    Tested-by: Barry Song <[email protected]>
    (cherry picked from commit 2fe86e0004076128f05d5a774b5c9c03d9dc3de2)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>

commit 936e23ee1a0cf7323f5f9d20d6f885eacb2008a7
Author: Michal Nazarewicz <[email protected]>
Date:   Mon Oct 29 16:50:18 2012 +0900

    mm: page_alloc: remove trailing whitespace

    Signed-off-by: Michal Nazarewicz <[email protected]>
    Signed-off-by: Marek Szyprowski <[email protected]>
    Acked-by: Mel Gorman <[email protected]>
    (cherry picked from commit 5f63b720b62925ef3c6a85473dcd547b0fd90616)

    Signed-off-by: Damian Hobson-Garcia <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>
koct9i referenced this pull request in koct9i/linux Sep 23, 2014
@hnaz
linux-next
fa4bbc5 
GIT 1b28f1c3d6821c20f42c22e977999fffbf0c0331

commit 78cbcabd472b197dc8ae7abd11f197efe611211a
Author: Peter Foley <[email protected]>
Date:   Mon Sep 22 09:31:10 2014 +1000

    Documentation: disable vdso_test to avoid breakage with old glibc
    
    glibc versions older than 2.16 don't include sys/auxv.h which this
    executable uses.
    Since we don't have a good way to test for specific glibc versions in
    kbuild, just disable it for now.
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit c5a967ad6aba3adc9b61f28d799be4fdf815e6bf
Author: Peter Foley <[email protected]>
Date:   Mon Sep 22 09:31:10 2014 +1000

    Documentation: update vDSO makefile to build portable examples
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit dee40f0c69658d15a49a3dbca4f105410f561ad4
Author: Peter Foley <[email protected]>
Date:   Mon Sep 22 09:31:09 2014 +1000

    Documentation: update .gitignore files
    
    Add some missing files to .gitignore.
    Push Documentation/.gitignore down into subdirectories.
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit 7f73b38710908162de63e9c940e1a0c26810dd19
Author: Peter Foley <[email protected]>
Date:   Mon Sep 22 09:31:09 2014 +1000

    Documentation: support glibc versions without htole macros
    
    glibc 2.9 introduced the htole<16/32/64> macros, add them to
    tools/include to support older versions of glibc.
    
    Reported-by: Andrew Morton <[email protected]>
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit c06fccd3288d690700b0d2824485ba925d09abd4
Author: Mark Brown <[email protected]>
Date:   Mon Sep 22 09:31:08 2014 +1000

    v4l2-pci-skeleton: Only build if PCI is available
    
    Currently arm64 does not support PCI but it does support v4l2. Since the
    PCI skeleton driver is built unconditionally as a module with no dependency
    on PCI this causes build failures for arm64 allmodconfig. Fix this by
    defining a symbol VIDEO_PCI_SKELETON for the skeleton and conditionalising
    the build on that.
    
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]> [added VIDEO dependencies]

commit c735483de1a2cd5d6c6b67bf49cfb2991eae6ea6
Author: Helge Deller <[email protected]>
Date:   Sun Sep 21 22:31:08 2014 +0200

    parisc: pdc_stable.c: Avoid potential stack overflows
    
    Signed-off-by: Helge Deller <[email protected]>

commit 94c457deff2a211f8372f69a4d7b0d288183756a
Author: Rickard Strandqvist <[email protected]>
Date:   Sun Sep 14 18:02:12 2014 +0200

    parisc: pdc_stable.c: Cleaning up unnecessary use of memset in conjunction with strncpy
    
    Using memset before strncpy just to ensure a trailing null character is
    an unnecessary double writing of a string
    
    Patch modified by Helge Deller to additionally reduce stack usage.
    
    Signed-off-by: Rickard Strandqvist <[email protected]>
    Signed-off-by: Helge Deller <[email protected]>

commit fe5c873459a973e59854bd235a7e6b3eaa8e5fe0
Author: Helge Deller <[email protected]>
Date:   Sun Sep 21 21:01:15 2014 +0200

    parisc: ptrace: use secure_computing_strict()
    
    Signed-off-by: Helge Deller <[email protected]>

commit 5466112f0935f079e225514905c57d5e5285a9b6
Author: Trond Myklebust <[email protected]>
Date:   Thu Sep 18 17:03:46 2014 -0400

    pnfs/blocklayout: Fix a 64-bit division/remainder issue in bl_map_stripe
    
    kbuild test robot reports:
    
       fs/built-in.o: In function `bl_map_stripe':
       >> :(.text+0x965b4): undefined reference to `__aeabi_uldivmod'
       >> :(.text+0x965cc): undefined reference to `__aeabi_uldivmod'
       >> :(.text+0x96604): undefined reference to `__aeabi_uldivmod'
    
    Fixes: 5c83746a0cf2 (pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing)
    Cc: Stephen Rothwell <[email protected]>
    Cc: Christoph Hellwig <[email protected]>
    Reviewed-by: Christoph Hellwig <[email protected]>
    Signed-off-by: Trond Myklebust <[email protected]>

commit 9c58c79a8a76c510cd3a5012c536d4fe3c81ec3b
Author: Zhihui Zhang <[email protected]>
Date:   Sat Sep 20 21:24:36 2014 -0400

    sched: Clean up some typos and grammatical errors in code/comments
    
    Signed-off-by: Zhihui Zhang <[email protected]>
    Cc: [email protected]
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ingo Molnar <[email protected]>

commit 6a40281ab5c1ed8ba2253857118a5d400a2d084b
Author: Chuck Ebbert <[email protected]>
Date:   Sat Sep 20 10:17:51 2014 -0500

    sched: Fix end_of_stack() and location of stack canary for architectures using CONFIG_STACK_GROWSUP
    
    Aaron Tomlin recently posted patches [1] to enable checking the
    stack canary on every task switch. Looking at the canary code, I
    realized that every arch (except ia64, which adds some space for
    register spill above the stack) shares a definition of
    end_of_stack() that makes it the first long after the
    threadinfo.
    
    For stacks that grow down, this low address is correct because
    the stack starts at the end of the thread area and grows toward
    lower addresses. However, for stacks that grow up, toward higher
    addresses, this is wrong. (The stack actually grows away from
    the canary.) On these archs end_of_stack() should return the
    address of the last long, at the highest possible address for the stack.
    
    [1] http://lkml.org/lkml/2014/9/12/293
    
    Signed-off-by: Chuck Ebbert <[email protected]>
    Link: http://lkml.kernel.org/r/20140920101751.6c5166b6@as
    Signed-off-by: Ingo Molnar <[email protected]>
    Tested-by: James Hogan <[email protected]> [metag]
    Acked-by: James Hogan <[email protected]>
    Acked-by: Aaron Tomlin <[email protected]>

commit 0c7bf3e8cab7900e17ce7f97104c39927d835469
Author: Zefan Li <[email protected]>
Date:   Sat Sep 20 14:49:10 2014 +0800

    cgroup: remove redundant variable in cgroup_mount()
    
    Both pinned_sb and new_sb indicate if a new superblock is needed,
    so we can just remove new_sb.
    
    Note now we must check if kernfs_tryget_sb() returns NULL, because
    when it returns NULL, kernfs_mount() may still re-use an existing
    superblock, which is just allocated by another concurent mount.
    
    Suggested-by: Tejun Heo <[email protected]>
    Signed-off-by: Zefan Li <[email protected]>
    Signed-off-by: Tejun Heo <[email protected]>

commit 3e2cd91ab92665148616a80dc0745c499d2746a7
Author: Zefan Li <[email protected]>
Date:   Sat Sep 20 14:35:43 2014 +0800

    cgroup: fix missing unlock in cgroup_release_agent()
    
    The patch 971ff4935538: "cgroup: use a per-cgroup work for release
    agent" from Sep 18, 2014, leads to the following static checker
    warning:
    
    	kernel/cgroup.c:5310 cgroup_release_agent()
    	warn: 'mutex:&cgroup_mutex' is sometimes locked here and sometimes unlocked.
    
    Reported-by: Dan Carpenter <[email protected]>
    Signed-off-by: Zefan Li <[email protected]>
    Signed-off-by: Tejun Heo <[email protected]>

commit 93b8877471796c04c16fdef755d4e5c0f521509f
Author: Alexander Shiyan <[email protected]>
Date:   Sat Sep 20 09:34:45 2014 +0400

    tty: serial_mctrl_gpio: Fix COMPILE_TEST build for architectures with custom termios.h
    
    This patch fixes COMPILE_TEST build of serial_mctrl_gpio module for
    architectures with custom termios.h header.
    
    sparc64:allmodconfig:
    
    In file included from drivers/tty/serial/serial_mctrl_gpio.c:21:0:
    include/uapi/asm-generic/termios.h:22:8: error: redefinition of 'struct termio'
    ./arch/sparc/include/uapi/asm/termbits.h:16:8: note: originally defined here
    make[3]: *** [drivers/tty/serial/serial_mctrl_gpio.o] Error 1
    
    Reported-by: Guenter Roeck <[email protected]>
    Signed-off-by: Alexander Shiyan <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d07fe967189ff7c32f5a78b4f28c2ccbab850091
Author: Chen-Yu Tsai <[email protected]>
Date:   Thu Sep 18 11:24:40 2014 +0800

    ARM: dts: sun8i: Add DMA controller node
    
    Add the DMA controller node and DMA bindings to the supported devices.
    
    Signed-off-by: Chen-Yu Tsai <[email protected]>
    Signed-off-by: Maxime Ripard <[email protected]>

commit e625305b390790717cf2cccf61efb81299647028
Author: Tejun Heo <[email protected]>
Date:   Sat Sep 20 01:27:25 2014 -0400

    percpu-refcount: make percpu_ref based on longs instead of ints
    
    percpu_ref is currently based on ints and the number of refs it can
    cover is (1 << 31).  This makes it impossible to use a percpu_ref to
    count memory objects or pages on 64bit machines as it may overflow.
    This forces those users to somehow aggregate the references before
    contributing to the percpu_ref which is often cumbersome and sometimes
    challenging to get the same level of performance as using the
    percpu_ref directly.
    
    While using ints for the percpu counters makes them pack tighter on
    64bit machines, the possible gain from using ints instead of longs is
    extremely small compared to the overall gain from per-cpu operation.
    This patch makes percpu_ref based on longs so that it can be used to
    directly count memory objects or pages.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Cc: Kent Overstreet <[email protected]>
    Cc: Johannes Weiner <[email protected]>

commit 4843c3320c3d23ab4ecf520f5eaf485aff8c7252
Author: Tejun Heo <[email protected]>
Date:   Sat Sep 20 01:27:24 2014 -0400

    percpu-refcount: improve WARN messages
    
    percpu_ref's WARN messages can be a lot more helpful by indicating
    who's the culprit.  Make them report the release function that the
    offending percpu-refcount is associated with.  This should make it a
    lot easier to track down the reported invalid refcnting operations.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Cc: Kent Overstreet <[email protected]>

commit 6d967f8789249628a6388a3a4314c5fef423f36a
Author: Andy Zhou <[email protected]>
Date:   Fri Sep 19 18:02:53 2014 -0700

    udp_tunnel: Only build ip6_udp_tunnel.c when IPV6 is selected
    
    Functions supplied in ip6_udp_tunnel.c are only needed when IPV6 is
    selected. When IPV6 is not selected, those functions are stubbed out
    in udp_tunnel.h.
    
    ==================================================================
     net/ipv6/ip6_udp_tunnel.c:15:5: error: redefinition of 'udp_sock_create6'
         int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
     In file included from net/ipv6/ip6_udp_tunnel.c:9:0:
          include/net/udp_tunnel.h:36:19: note: previous definition of 'udp_sock_create6' was here
           static inline int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
    ==================================================================
    
    Fixes:  fd384412e udp_tunnel: Seperate ipv6 functions into its own file
    Reported-by: kbuild test robot <[email protected]>
    Signed-off-by: Andy Zhou <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 3f76a4ea5383ba2f9e76f9625f77ff246907a134
Author: Mahati Chamarthy <[email protected]>
Date:   Thu Sep 18 19:27:09 2014 +0530

    Staging: rtl8192e: Fix __constant_htons to htons style warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: __constant_htons should be htons
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 288903f6b91e759b0a813219acd376426cbb8f14
Author: Catalina Mocanu <[email protected]>
Date:   Fri Sep 19 15:55:05 2014 -0700

    staging: iio: cdc: Don't put an else right after a return
    
    This fixes the following checkpatch.pl warning:
    WARNING: else is not generally useful after a break or return.
    
    While at it, remove new line for symmetry with the rest of the code.
    
    Signed-off-by: Catalina Mocanu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0a5fcc6b2efdc86619af793e0216a508469cfaa4
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 23:32:05 2014 +0300

    staging: octeon: Fix quoted string split warning.
    
    This patch fixes "quoted string split across lines" checkpatch.pl
    warning in ethernet.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 39bc7513aa92b38c391dbe9649841f9f9dfcd0ac
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 23:27:39 2014 +0300

    staging: octeon: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    ethernet.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1ff99b312f9c94516acb38bad7421ba1d74abeb2
Author: Roberta Dobrescu <[email protected]>
Date:   Fri Sep 19 23:34:36 2014 +0300

    staging: emxx_udc: Replace __constant_cpu_to_le16 with cpu_to_le16
    
    This fixes the following checkpatch.pl warning:
    WARNING: __constant_cpu_to_le16 should be cpu_to_le16
    Additionally, it removes the space between function name and (.
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 113f5f24c6be6f7d888946320d01b51b81aa213d
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 00:31:44 2014 +0300

    Staging: rtl8821ae: Fix warnings of no space before tabs.
    
    This patch fixes these warning messages found by checkpatch.pl:
    WARNING: please, no space before tabs.
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a45cbb78147e8f57250f1687f5b61470b8343a20
Author: Aybuke Ozdemir <[email protected]>
Date:   Thu Sep 18 23:56:13 2014 +0300

    Staging: rtl8821ae: Fix "foo * bar" warning.
    
    This patch fixes these error messages found by checkpatch.pl:
    ERROR: "foo* bar" should be "foo *bar"
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 34c376fe07342e06f531504b01d3b953962e456c
Author: Aybuke Ozdemir <[email protected]>
Date:   Thu Sep 18 01:03:28 2014 +0300

    Staging: wlan-ng: Fix return in void function warning
    
    This fixes checkpatch.pl warning:
    WARNING: void function return statements are not generally useful
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fcf1b73d08cd15912205f3b259ea81ccfde11970
Author: Aybuke Ozdemir <[email protected]>
Date:   Thu Sep 18 00:54:04 2014 +0300

    Staging: media: cxd2099: Missing a blank line after declarations
    
    Fix checkpatch.pl issues with missing a blank
    line after declarations in cxd2099.c
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c2e91542695270452ea7b5d3266ad0e9b5dc7bdb
Author: Aybuke Ozdemir <[email protected]>
Date:   Wed Sep 17 23:43:15 2014 +0300

    Staging: octeon: Missing a blank line after declarations
    
    Fix checkpatch.pl issues with missing a blank
    line after declarations in ethernet-sgmii.c
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 05fd349b1750d456423538e69c3c1d4d8a10f1c8
Author: Aybuke Ozdemir <[email protected]>
Date:   Wed Sep 17 16:10:36 2014 +0300

    staging: gs_fpgaboot Fix trailing whitespace.
    
    Fix checkpatch.pl issues with trailing
    whitespace in README.
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit de77c125f57a308250cfaec945541fd8abe0e054
Author: Aybuke Ozdemir <[email protected]>
Date:   Wed Sep 17 15:33:25 2014 +0300

    staging: bcm: Fix line over 80 characters
    
    Fix checkpatch.pl issues with
    line over 80 characters in HandleControlPacket.c
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5ad6ae1acfd883d8f4c8998b4e5bc9d4aea7985f
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 01:20:44 2014 +0300

    staging: media: lirc: Fixes missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    lirc_serial.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>.
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a5613fe8967534ce626875fab4bcface70d366b4
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 01:26:03 2014 +0300

    staging: media: lirc: Fixes unnecessary return warning.
    
    This patch fixes "void function return statements are not generally
    useful" checkpatch.pl warning in lirc_zilog.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a17ec4c9fd07d3f4760cc6545b54f8323ea6ccb4
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 01:06:55 2014 +0300

    staging: media: lirc: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    lirc_bt829.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3f8028023c3f6804751a920d97e9c8dffc575cc0
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 01:02:21 2014 +0300

    staging: media: lirc: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    lirc_sasem.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a87ba73ed10266dba8278b2a6b89da597a38092a
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 00:59:11 2014 +0300

    staging: media: lirc: Fix unnecessary return warning.
    
    This patch fixes "void function return statements are not generally
    useful" checkpatch.pl warning in lirc_sasem.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fd8392f3097140a9db7b0903a63635e652b6eb45
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 22:46:57 2014 +0300

    staging: media: lirc: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    lirc_zilog.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3170f3277b1809c19fe4a45914cffa0e09471973
Author: Tina Johnson <[email protected]>
Date:   Wed Sep 17 03:14:52 2014 +0530

    Staging: media: lirc: lirc_imon: Removed unnecessary variable to simplify return variable handling
    
    Variable rc was removed after merging its assignment statement with
    immediately following return statement. Variable retval is not used
    at all other that to return its initial value.Hence replaced retval
    with its initial value in the return statement and removed the variable.
    
    This patch was done using Coccinelle script and the following semantic
    patch was used:
    
    @rule1@
    identifier ret;
    expression e;
    @@
    
    -int ret = 0;
     ... when != ret
    (
    -ret = e;
    +return e;
    -return ret;
    |
    -return ret;
    +return 0;
    )
    
    Signed-off-by: Tina Johnson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 8ad5360ad81a32b4e9fdc956e7c453308050a97d
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 21:39:46 2014 +0300

    staging: lustre: lnet: lnet: Fixed quoted string split warning.
    
    This patch fixes "quoted string split across lines" checkpatch.pl
    warning in api-ni.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 70b694c32e405cff8e2640b3943ed9598d97f75e
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 21:48:00 2014 +0300

    staging: lustre: lnet: lnet: Fix missing line warning.
    
    This patch fixes "Fixes "Missing a blank line after declarations"
    checkpatch.pl warning in api-ni.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a446b47d5d815865c2715da8fab1a7c06f1338ca
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 21:53:31 2014 +0300

    staging: lustre: lnet: lnet: Fix quoted string split warning.
    
    This patch fixes "quoted string split across lines" checkpatch.pl
    warning in lib-eq.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3e9cc5b0450a40be3442a82a5a5293f85ca06c7d
Author: Darshana Padmadas <[email protected]>
Date:   Wed Sep 17 20:58:43 2014 +0530

    Staging: lustre: Fix return in void function warning
    
    This fixes checkpatch.pl warning:
    
    WARNING: void function return statements are not generally useful
    
    Signed-off-by: Darshana Padmadas <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6606a77f92821f8bfd4b1b6ba296da662fecb640
Author: Darshana Padmadas <[email protected]>
Date:   Wed Sep 17 20:28:54 2014 +0530

    Staging: lustre: place open brace following struct on same line
    
    This patch fixes checkpatch.pl warning:
    
    WARNING: open brace following struct goes on the same line.
    
    Signed-off-by: Darshana Padmadas <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 4467a945fc08c0d6624b1dd64cfcc2cbd3b3dee3
Author: Darshana Padmadas <[email protected]>
Date:   Wed Sep 17 18:14:45 2014 +0530

    Staging: lustre: libcfs: fix checkpatch warning else after return statement
    
    Fix checkpatch warning by removing unnecessary else after return statement.
    
    Signed-off-by: Darshana Padmadas <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f5740b2e7e74fa9ba915aa74bfba7cf849dce8a7
Author: Darshana Padmadas <[email protected]>
Date:   Tue Sep 16 13:24:13 2014 +0530

    Staging: lustre: include: libcfs: removed else before return statement in libcfs_crypto.h
    
    This is a patch to libcfs_crypto.h that fixes warning on unnecessary else before return statement found by checkpatch.pl tool.
    
    Signed-off-by: Darshana Padmadas <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 225557bf274ed1519362865815da7425533191d1
Author: Roxana Blaj <[email protected]>
Date:   Mon Sep 15 14:58:44 2014 +0300

    staging: speakup: fix checkpatch warning
    
    This fixes the checkpatch warning:
    WARNING: line over 80 characters
    
    Signed-off-by: Roxana Blaj <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0a3a725adb2c421ea79089ea12004a007fb371ce
Author: Roxana Blaj <[email protected]>
Date:   Sun Sep 14 20:28:53 2014 +0300

    staging: speakup: fix checkpatch warning
    
    This fixes the cheackpatch warning:
    WARNING: Missing a blank line after declarations
    
    Signed-off-by: Roxana Blaj <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 472fe30efd52fde30249a04971a62151e0606c1d
Author: Nicoleta Birsan <[email protected]>
Date:   Sun Sep 14 03:38:34 2014 -0700

    Staging: speakup: fix checkpatch warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: Missing a blank line after declarations
    
    Signed-off-by: Nicoleta Birsan <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 297cbdaeca2b68aaae6bbb7affa4533430e8e91a
Author: Blaj Roxana <[email protected]>
Date:   Tue Sep 16 20:13:28 2014 +0300

    staging: skein: replace spaces with tabs
    
    This fixes the error and warning:
    ERROR: code indent should use tabs where possible
    WARNING: please, no spaces at the start of a line
    
    Signed-off-by: Blaj Roxana <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fb33aa47a00edc789d17d80174cd3ed8a1c82c66
Author: Roberta Dobrescu <[email protected]>
Date:   Sat Sep 20 00:01:39 2014 +0300

    staging: dgnc: Check sscanf return value
    
    This fixes the following checkpatch.pl warnings:
    WARNING: unchecked sscanf return value
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f23e875fd26a05a0850db7c5e090030c80b4f583
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 19:34:45 2014 +0300

    staging: dgnc: Fix unnecessary space warning.
    
    Fixed "Unnecessary space before function pointer argument" checkpatch.pl
    warning in dgnc_driver.h
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e8756d4a51d1246be36c5621827c288eb2d5e9b7
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 19:31:15 2014 +0300

    staging: dgnc: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    dgnc_sysfs.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3dfe7557809e5867306c7a0614b9d1c6036cbe4d
Author: Vaishali Thakkar <[email protected]>
Date:   Fri Sep 19 10:30:59 2014 +0530

    Staging: dgnc: Merge lines and remove unused variable for immediate return
    
    This patch merges two lines in a single line if immediate
    return is found. It also removes unnecessory variable rc
    as it is no longer needed.
    
    This is done using Coccinelle. Semantic patch used for this
    is as follows:
    
    @@
    type T;
    identifier i;
    identifier f;
    constant C;
    @@
    - T i;
      ...when != i
         when strict
    (
      return -C;
    |
    - i =
    + return
         f(...);
    - return i;
    )
    
    Signed-off-by: Vaishali Thakkar <[email protected]>
    Reviewed-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 10352c2a69f4aa2724f007a4922518c9ece7bf89
Author: Roberta Dobrescu <[email protected]>
Date:   Thu Sep 18 21:38:04 2014 +0300

    staging: dgnc: Move open brace on previous line
    
    This fixes the following checkpatch.pl errors:
    ERROR: that open brace { should be on the previous line
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 05a70e14035438e6866d7fcf8a79c67b8e1425e1
Author: Roberta Dobrescu <[email protected]>
Date:   Tue Sep 16 20:33:03 2014 +0300

    staging: dgnc: Do not initialise statics to 0 or NULL
    
    This fixes the following checkpatch.pl error:
    ERROR: do not initialise statics to 0 or NULL
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Acked-by: Daniel Baluta <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b051017fb4e593998fc46ec9a991ad390c9114b5
Author: Roberta Dobrescu <[email protected]>
Date:   Mon Sep 15 21:32:59 2014 +0300

    staging: dgnc: Replace kzalloc with kcalloc
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Prefer kcalloc over kzalloc with multiply
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f3dadd29f7197d93d0441391f5e3815bf008cce1
Author: Roberta Dobrescu <[email protected]>
Date:   Sun Sep 14 23:13:20 2014 +0300

    staging: dgnc: Fix warnings relating to printk()
    
    This fixes the following checkpatch.pl warnings:
    WARNING: printk() should include KERN_ facility level
    It replaces printk() with dev_dbg() in order to avoid the warning that a more
    specific function should be used.
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 2be13f7b7c63cecc439876c8c06a5b30afdf46f9
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 04:59:59 2014 +0530

    Staging: rtl8192ee: rtl8192ee: Fix missing blank line warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Missing a blank line after declarations
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b9209a93edbccafb6c2f860bc0ddfe9eda1e3ccd
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 04:49:43 2014 +0530

    Staging: rtl8192ee: Fix else not useful style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1709a582e1f8977de040f02d9e9e52ec89f8603f
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 04:03:36 2014 +0530

    Staging: rtl8192ee: Fix break is not useful warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: break is not useful after a goto or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fe6dc85eaf8bb180ad3510a57bd69f3b8f9c2dbb
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 03:42:01 2014 +0530

    Staging: rtl8192ee: Fix else is not useful warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f41788b7c933127863435f72f456ec46ed5540b2
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 03:29:19 2014 +0530

    Staging: rtl8192ee: Fix missing blank line warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Missing a blank line after declarations
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ad39fe743419d58f9bc29373189c93ba2251e675
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 02:43:26 2014 +0530

    Staging: rtl8192e: Fix printk debug style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Prefer [subsystem eg: netdev]_dbg([subsystem]dev, ... then dev_dbg(dev,
     ... then pr_debug(...  to printk(KERN_DEBUG ...
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 4344672830d8500eac97d82976b03e41580c3a04
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 02:40:43 2014 +0530

    Staging: rtl8192e: Fix printk style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Prefer [subsystem eg: netdev]_info([subsystem]dev, ... then dev_info(dev, ... then pr_info(...  to printk(KERN_INFO ...
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6af197672f2330045c171aed3ea90fb93d89ecc6
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 02:38:39 2014 +0530

    Staging: rtl8192e: Fix space before semicolon warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: space prohibited before semicolon
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 13402f7b76223e7f50ab42c82aac4788940c8277
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 02:36:31 2014 +0530

    Staging: rtl8192e: Fix else is not useful warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5110e40260d03fdb2d93a94fec06a31b81d57b0b
Author: Mahati Chamarthy <[email protected]>
Date:   Fri Sep 19 23:56:02 2014 +0530

    Staging: rtl8192e: Fix void function return statements style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING:  void function return statements are not generally useful
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 59422a74b55c616d500c3be721077ff0d00f7fb0
Author: Mahati Chamarthy <[email protected]>
Date:   Fri Sep 19 23:12:53 2014 +0530

    Staging: rtl8192e: Fix else is not useful style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1f921b9f61b1a324366c8f6a02c5a8e89164ed52
Author: Vaishali Thakkar <[email protected]>
Date:   Fri Sep 19 22:22:19 2014 +0530

    Staging: rtl8192e: Fixed style warning relating to printk()
    
    This patch fixes following checkpatch.pl warning in file rtl_dm.c:
    
    WARNING: Prefer [subsystem eg: netdev]_info([subsystem]dev, ... then dev_info(dev, ... then pr_info(...  to printk(KERN_INFO .
    
    Signed-off-by: Vaishali Thakkar <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 52e93b8ab435978bc12280aa4418ef25fd6e74f2
Author: Mahati Chamarthy <[email protected]>
Date:   Fri Sep 19 05:22:33 2014 +0530

    Staging: rtl8192e: Fix unnecessary parentheses style warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: Unnecessary parentheses - maybe == should be = ?
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fee9d3e61d04422628a3d22ed5eb8370dcef259b
Author: Chris J Arges <[email protected]>
Date:   Wed Aug 27 13:26:53 2014 -0500

    ktest: add ability to skip during BISECT_MANUAL
    
    When doing a manual bisect, a build can fail or a test can be inconclusive.
    In these cases it would be helpful to be able to skip the test entirely.
    
    Link: http://lkml.kernel.org/r/[email protected]
    
    Reviewed-by: Satoru Takeuchi <[email protected]>
    Signed-off-by: Chris J Arges <[email protected]>
    Signed-off-by: Steven Rostedt <[email protected]>

commit 4af409f6c38029e1eda0a5e7bbf15e9b1b7d7fab
Author: Benedict Boerger <[email protected]>
Date:   Thu Sep 18 17:46:23 2014 +0200

    staging: rtl8192u: delete unused function CAM_read_entry
    
    Fix the sparse warning: symbol 'CAM_read_entry' was not declared. Should it be static?
    
    The function CAM_read_entry is not used and therefore deleted.
    
    Signed-off-by: Benedict Boerger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 77baad9e4d71e75d7ad6ee83454113d4a6a7b04d
Author: Ragnar B. Johannsson <[email protected]>
Date:   Thu Sep 18 14:33:25 2014 +0000

    staging: rtl8192u: Move ieee80211_crypto_* declarations to ieee80211/ieee80211.h
    
    Move ieee80211_crypto*_init and _exit prototype declarations from r8192U_core.c to ieee80211/ieee80211.h. This fixes the following sparse warnings:
    
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.c:203:12: warning: symbol 'ieee80211_crypto_init' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.c:223:13: warning: symbol 'ieee80211_crypto_deinit' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c:764:12: warning: symbol 'ieee80211_crypto_tkip_init' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c:769:13: warning: symbol 'ieee80211_crypto_tkip_exit' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c:467:12: warning: symbol 'ieee80211_crypto_ccmp_init' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c:472:13: warning: symbol 'ieee80211_crypto_ccmp_exit' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c:281:12: warning: symbol 'ieee80211_crypto_wep_init' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c:286:13: warning: symbol 'ieee80211_crypto_wep_exit' was not declared. Should it be static?
    
    Signed-off-by: Ragnar B. Johannsson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5635b82a553620c511dc6bc8cb0990c0a791e21e
Author: Mahati Chamarthy <[email protected]>
Date:   Thu Sep 18 15:43:53 2014 +0530

    Staging: rtl8192e: Fix style warnings relating to printk(KERN_DEBUG
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Prefer [subsystem eg: netdev]_dbg([subsystem]dev, ... then dev_dbg(dev, ... then pr_debug(...  to printk(KERN_DEBUG ...
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fe40a0b361de10ea794116160308cc7fd0b7fbeb
Author: Vaishali Thakkar <[email protected]>
Date:   Wed Sep 17 08:35:24 2014 +0530

    Staging: rtl8192e: rtl8192e: Remove unnecessory braces and space
    
    This patch removes following checkpatch.pl warnings in rtl_core.c file:
    
    WARNING: Braces {} are not necessary for single statement blocks
    WARNING: Space prohibited before semicolon
    
    Signed-off-by: Vaishali Thakkar <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5c8b3961da9a55762ea5481e8f9412c0d18dc684
Author: Vaishali Thakkar <[email protected]>
Date:   Wed Sep 17 08:02:43 2014 +0530

    Staging: rtl8192e: rtl8192e: Remove unnecessory variable
    
    This patch removes unnecessory variable in file ret_core.c
    using coccinelle script.Semantic patch for this is as follows:
    
    @@
    identifier ret;
    @@
    
    -int ret = 0;
     ... when != ret
         when strict
    -return ret;
    +return 0;
    
    Signed-off-by: Vaishali Thakkar <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 23a0e1611b880bd8d94bbebcb3577c9f78029435
Author: Steven Rostedt (Red Hat) <[email protected]>
Date:   Fri Sep 19 20:10:39 2014 -0400

    ktest: Add PATCHCHECK_CHERRY
    
    Add a way to run a patchcheck test on the commits that are in one branch
    but not in another. This uses git cherry to find a list of commits to
    test each one with.
    
    Signed-off-by: Steven Rostedt <[email protected]>

commit 4309635f692192ddcc540964189d92cad0ade249
Author: Rajbinder Brar <[email protected]>
Date:   Tue Sep 16 11:25:31 2014 +0530

    Staging: vt6655: Break 80 character long line to remove checkpatch error
    
    This removes checkpatch.pl warning
    WARNING: line over 80 characters
    
    Signed-off-by: Rajbinder Brar <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b377ed4cce004d7c3dbd92cffdbf2aa21d28e2e6
Author: Rajbinder Brar <[email protected]>
Date:   Wed Sep 17 21:27:03 2014 +0530

    Staging: vt6656: Removing else after break statement to fix warning
    
    This patch fixes the checkpatch.pl warning in baseband.c file
    WARNING: else is not useful after a break or return
    
    Signed-off-by: Rajbinder Brar <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit dbc6ee63d4355a51fd84ee8ebf127763180b1585
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 19:49:33 2014 +0300

    Staging: vt6655: Fix C99 style commenting.
    
    This patch fixes these error messages found by checkpatch.pl:
    ERROR: do not use C99 // comments
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a600f4589fdbb51a0ad885408f996ec0f1f90be9
Author: Abel Moyo <[email protected]>
Date:   Thu Sep 18 21:49:10 2014 +0200

    Staging: gdm724x: gdm_usb: added error checking in do_tx()
    
    Added error checking for alloc_tx_struct in do_tx()
    
    Signed-off-by: Abel Moyo <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 37d963fb80d2fd944bd0124570b2adc5b826ccef
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 20:43:53 2014 +0300

    staging: gdm724x: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    gdm_mux.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 492a1e7be585c88a04ba763bb77fc865700e209d
Author: Daeseok Youn <[email protected]>
Date:   Tue Sep 16 16:19:06 2014 +0900

    staging: dgap: use schedule_timeout_interruptible() instead of dgap_ms_sleep()
    
    Using schedule_timeout_interruptible() is exactly same as
    setting a status of current process and calling  schedule_timeout().
    
    Removes dgap_ms_sleep(), because this function is used
    only when closing tty channel on dgap_tty_close().
    And also removes ch_close_delay that is always set to 250
    on dgap_tty_init().
    
    Signed-off-by: Daeseok Youn <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 335d9c85be096cf492cb3eaeef160b45e1f25d8d
Author: Ankita Patil <[email protected]>
Date:   Thu Sep 18 12:31:00 2014 +0530

    Staging: dgap: Remove unnecessary variable.
    
    This patch removes unnecessary variable in file dgap.c
    using Coccinelle. Semantic patch for this is as follows:
    
    @@
    expression ret;
    identifier f;
    @@
    
    -ret =
    +return
         f(...);
    -return ret;
    
    Also removed the unneeded variable manually.
    
    Signed-off-by: Ankita Patil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 50d0a21b61f22b38f881fa21d2ada6ab4a61f93f
Author: Purnendu Kapadia <[email protected]>
Date:   Mon Sep 15 13:06:36 2014 +0100

    staging: android: sw_sync: checkpatch fixes
    
       - no space after cast
       - allignment should match open parenthesis
       - remove unnecessary new line
    
    Signed-off-by: Purnendu Kapadia <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1f0f6c9862b687db36f5e853402f76bc118ff0bf
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 01:58:29 2014 +0300

    Staging: rtl8723au: hal: Space prohibited before semicolon
    
    This patch fixes these warning messages found by checkpatch.pl:
    WARNING: Space prohibited before semicolon.
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 8c09757d91703ccbf0da9fc67764de9714c9e615
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 02:23:53 2014 +0300

    Staging: rtl8723au: core: Fix unnecassary braces warning.
    
    This patch fixes these warning messages found by checkpatch.pl:
    WARNING: braces {} are not necessary for single statement blocks
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 867ce1bd68fb1eadb70b82bcda1e451b27ff824a
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 02:33:38 2014 +0300

    Staging: rtl8723au: core: Fix "foo * bar" warning.
    
    This patch fixes these error messages found by checkpatch.pl:
    ERROR: "foo* bar" should be "foo *bar"
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c895a5df852ca9bbac1dee413747303a61aa4ebd
Author: Greg Donald <[email protected]>
Date:   Tue Sep 16 18:37:41 2014 -0500

    drivers: staging: rtl8723au: Fix "space required after that ','" errors
    
    Fix checkpatch.pl "space required after that ','" errors
    
    Signed-off-by: Greg Donald <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f78c0710cd60cd108d436490955909983f309c62
Author: Kieron Browne <[email protected]>
Date:   Tue Sep 16 23:28:09 2014 +0100

    staging: rtl8723au: fix sparse incorrect type assignment warnings
    
    Use cpu_to_le16 to cast int for assignment to __le16 members
    
    Signed-off-by: Kieron Browne <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit adabff85c9486c09ec700d835328e18ccfc9abf0
Author: MihaelaGaman <[email protected]>
Date:   Sun Sep 14 12:56:43 2014 +0300

    staging: rtl8723au: Fix checkpatch errors
    
    Fix checkpatch.pl "spaces required around":
    >, =, =, =, =, +=, >, >, <, <, :, <  errors.
    
    Signed-off-by: MihaelaGaman <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1703c17b8a02b7d1dd3080c4ce9d41a83e95a071
Author: Vaishali Thakkar <[email protected]>
Date:   Sun Sep 14 13:46:37 2014 +0530

    Staging: rtl8188eu: os_dep: Compression of lines for immediate return
    
    This patch compresses two lines in to a single line in file rtw_android.c
    if immediate return statement is found. It also removes variable bytes_written as
    it is no longer needed.
    
    It is done using script Coccinelle. And coccinelle uses following semantic
    patch for this compression function:
    
    @@
    expression ret;
    identifier f;
    @@
    
    -ret =
    +return
         f(...);
    -return ret;
    
    Signed-off-by: Vaishali Thakkar<[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 16e614e85025d69c87e9ce80b9e1b5238f0f4479
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 00:13:29 2014 +0300

    staging: rtl8188eu: core: Fixed wrong space error.
    
    This patch fixes "foo     * bar" should be "foo   *bar" checkpatch.pl error in rtw_cmd.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 69869c01ff148ef22d0ea1adec27b4543789792b
Author: Catalina Mocanu <[email protected]>
Date:   Fri Sep 19 14:54:54 2014 -0700

    staging: iio: impedance-analyzer: add blank line after declaration
    
    This fixes the following checkpatch.pl warning:
    WARNING: Missing a blank line after declarations.
    
    Signed-off-by: Catalina Mocanu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 714ab9bdd350413f48ad401bd25e11b3e9f257ab
Author: Catalina Mocanu <[email protected]>
Date:   Fri Sep 19 14:32:09 2014 -0700

    staging: iio: trigger: add blank lines after declarations
    
    This fixes the following checkpatch.pl warning:
    WARNING: Missing a blank line after declarations.
    
    Signed-off-by: Catalina Mocanu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 8a689c114796d8a3801c2bf3e25d3e21d6816036
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 18:48:05 2014 +0300

    Staging: iio: resolver: Missing a blank line after declarations
    
    This patch fixes these warning messages found by checkpatch.pl:
    WARNING : Missing a blank line after declarations
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 4b4c727519b510ab9d9b33de51ea41fc34b9ef27
Author: Catalina Mocanu <[email protected]>
Date:   Thu Sep 18 14:55:06 2014 -0700

    staging: iio: dummy: add blank lines after declarations.
    
    This fixes the following checkpatch.pl warning:
    WARNING: Missing a blank line after declarations.
    
    Signed-off-by: Catalina Mocanu <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b581c3d9a90772613e05e659b4e8defc81704212
Author: Tina Johnson <[email protected]>
Date:   Sat Sep 13 15:46:15 2014 +0530

    Staging: iio: meter: ade7753: Fixed checkpatch.pl warnings
    
    Clean-up patch to fix the following checkpatch.pl warnings:
    
    ade7753.c:325: WARNING: Missing a blank line after declarations
    ade7753.c:383: WARNING: Missing a blank line after declarations
    
    Signed-off-by: Tina Johnson<[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 9034720a54738bbaf96b619f34f887199ac7efed
Author: Tina Johnson <[email protected]>
Date:   Sun Sep 14 16:30:05 2014 +0530

    Staging: iio: meter: ade7753: Merged assignment with immediately following return statement
    
    Saved one line of code by merging the assigning and return statements
    of variable ret. And thus removed variable len which was no longer useful.
    
    This patch was done using Coccinelle script and the following semantic
    patch was used:
    
    @@
    expression ret;
    identifier f;
    @@
    
    -ret =
    +return
          f(...);
    -return ret;
    
    Signed-off-by: Tina Johnson <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Acked-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 18f340f90e087c078c634d5c4fed5e0d632d4fb6
Author: Paul Zimmerman <[email protected]>
Date:   Fri Sep 19 14:49:36 2014 -0700

    usb: dwc2: add T: line to MAINTAINERS showing Felipe's tree
    
    Starting with v3.18-rc, patches for dwc2 will go through Felipe's
    tree. Add a T: line to MAINTAINERS to document this.
    
    Signed-off-by: Paul Zimmerman <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5dce95554a1866339de039060ecd7122056a9d71
Author: Paul Zimmerman <[email protected]>
Date:   Tue Sep 16 13:47:27 2014 -0700

    usb: dwc2: handle DMA buffer unmapping sanely
    
    The driver's handling of DMA buffers for non-aligned transfers
    was kind of nuts. For IN transfers, it left the URB DMA buffer
    mapped until the transfer completed, then synced it, copied the
    data from the bounce buffer, then synced it again.
    
    Instead of that, just call usb_hcd_unmap_urb_for_dma() to unmap
    the buffer before starting the transfer. Then no syncing is
    required when doing the copy. This should also allow handling of
    other types of mappings besides just dma_map_single() ones.
    
    Also reduce the size of the bounce buffer allocation for Isoc
    endpoints to 3K, since that's the largest possible transfer size.
    
    Tested on Raspberry Pi and Altera SOCFPGA.
    
    Signed-off-by: Paul Zimmerman <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e8f8c14d9da7ab1b8a7b0f769cd7148ca2cc7d10
Author: Paul Zimmerman <[email protected]>
Date:   Tue Sep 16 13:47:26 2014 -0700

    usb: dwc2: clip max_transfer_size to 65535
    
    Clip max_transfer_size to 65535 for host. dwc2_hc_setup_align_buf()
    allocates coherent buffers with this size, and if it's too large we
    can exhaust the coherent DMA pool.
    
    Tested on Raspberry Pi and Altera SOCFPGA.
    
    Signed-off-by: Paul Zimmerman <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d00b41428042e72d9dc2557d9147434a4e3d631f
Author: Robert Baldyga <[email protected]>
Date:   Tue Sep 9 10:44:57 2014 +0200

    usb: dwc2/gadget: disable clock when it's not needed
    
    When device is stopped or suspended clock is not needed so we
    can disable it for this time.
    
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b203d0a2e32dd28e87780078f0789322862e4da8
Author: Robert Baldyga <[email protected]>
Date:   Tue Sep 9 10:44:56 2014 +0200

    usb: dwc2/gadget: assign TX FIFO dynamically
    
    Because we have not enough memory to have each TX FIFO of size at least
    3072 bytes (the maximum single packet size with 3 transactions per
    microframe), we create four FIFOs of lenght 1024, and four of length
    3072 bytes, and assing them to endpoints dynamically according to
    maxpacket size value of given endpoint.
    
    Up to now there were initialized 16 TX FIFOs, but we use only 8 IN
    endpoints, so we can split available memory for 8 FIFOs to have more
    memory for each one.
    
    It needed to do some small modifications in few places in code, because
    there was assumption that TX FIFO numbers assigned to endpoints are the
    same as the endpoint numbers, which is not true since we have dynamic
    FIFO assigning.
    
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit cff9eb756e18a7763d7ab9c574c0ab191e712341
Author: Marek Szyprowski <[email protected]>
Date:   Tue Sep 9 10:44:55 2014 +0200

    usb: dwc2/gadget: ensure that all fifos have correct memory buffers
    
    Print warning if FIFOs are configured in such a way that they don't fit
    into the SPRAM available on the s3c hsotg module.
    
    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1e01129373f757925a652ea4ea5b278f8c2b9222
Author: Marek Szyprowski <[email protected]>
Date:   Tue Sep 9 10:44:54 2014 +0200

    usb: dwc2/gadget: hide some not really needed debug messages
    
    Some DWC2/s3c-hsotg debug messages are really useless for typical user,
    so hide them behind dev_dbg().
    
    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d784f1e50977e58db23a79181971c3c0f62452e5
Author: Andrzej Pietrasiewicz <[email protected]>
Date:   Tue Sep 9 10:44:53 2014 +0200

    usb: dwc2/gadget: Fix comment text
    
    Adjust the debug text to the name of the printed variable.
    
    Signed-off-by: Andrzej Pietrasiewicz <[email protected]>
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 496a51bd64eb15f14cee3519f5b75b28d09567e3
Author: Julia Lawall <[email protected]>
Date:   Thu Sep 18 22:24:02 2014 +0200

    staging: lustre: llite: Use kzalloc and rewrite null tests
    
    This patch removes some kzalloc-related macros and rewrites the
    associated null tests to use !x rather than x == NULL.
    
    A simplified version of the semantic patch that makes this change is as
    follows: (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @@
    expression ptr;
    statement S,S1;
    @@
    
      \(OBD_ALLOC\|OBD_ALLOC_WAIT\|OBD_ALLOC_PTR\|OBD_ALLOC_PTR_WAIT\)(ptr,...);
      if (
    +     !
          ptr
    -      == NULL
         ) S else S1
    
    @@
    expression ptr,size;
    @@
    
    - OBD_ALLOC(ptr,size)
    + ptr = kzalloc(size, GFP_NOFS)
    
    @@
    expression ptr,size;
    @@
    
    - OBD_ALLOC_WAIT(ptr,size)
    + ptr = kzalloc(size, GFP_KERNEL)
    
    @@
    expression ptr,size;
    @@
    
    - OBD_ALLOC_PTR(ptr)
    + ptr = kzalloc(sizeof(*ptr), GFP_NOFS)
    
    @@
    expression ptr,size;
    @@
    
    - OBD_ALLOC_PTR_WAIT(ptr,size)
    + ptr = kzalloc(sizeof(*ptr), GFP_KERNEL)
    // </smpl>
    
    Signed-off-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit cdbcd3305293d18f7ae73b2766699bddf634bb06
Author: Martin Kelly <[email protected]>
Date:   Mon Sep 15 21:16:15 2014 -0700

    Staging/bcm: Fix whitespace/comments in Ioctl.h
    
    Cleanup whitespace and comments in Ioctl.h in a few ways:
    - > 80 character cleanup
    - Comment clarification
    - More consistent vertical alignment
    
    Signed-off-by: Martin Kelly <[email protected]>
    Reviewed-by: Matthias Beyer <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 33b443e467f6c92c4cc797f5acf6a933fcfe9ec3
Author: Fabien Malfoy <[email protected]>
Date:   Mon Sep 15 09:02:36 2014 +0200

    staging: rtl8821ae: Remove space after unary operator in efuse.c
    
    Several pointer declaration syntax have been fixed to match the coding style.
    
    Signed-off-by: Fabien Malfoy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c24cdca05edb9c5435529afa37ce8c9c25ac4c5e
Author: Merlin Chlosta <[email protected]>
Date:   Mon Sep 15 01:56:10 2014 +0200

    staging: rtl8192u: sparse warnings: declare ieee80211_TURBO_Info static
    
    Declare ieee80211_TURBO_Info static to fix a sparse "symbol was not declared" warning.
    
    Signed-off-by: Merlin Chlosta <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5b1ebbffc0b2dd47a45380ba68da36f792a2977e
Author: Vincenzo Scotti <[email protected]>
Date:   Sat Sep 13 13:39:20 2014 +0200

    staging: emxx_udc: fix compile warnings: discarding const qualifier
    
    Signed-off-by: Vincenzo Scotti <[email protected]>
    Reported-by: kbuild test robot <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f02935c575cb00f2a164282866324816a1f52fc1
Author: Masanari Iida <[email protected]>
Date:   Sat Sep 13 01:14:30 2014 +0900

    staging: exxx_udc: Convert pr_warning to pr_warn
    
    This patch Convert pr_warning to pr_warn.
    
    Signed-off-by: Masanari Iida <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3aa2ec581903747d926765850212278c7c24be77
Author: Sudip Mukherjee <[email protected]>
Date:   Fri Sep 12 17:57:26 2014 +0530

    staging: unisys: uislib: uislib.c: sparse warning of context imbalance
    
    fixed sparse warning : context imbalance in 'destroy_device'
                            unexpected unlock
    this patch will generate warning from checkpatch for
    lines over 80 character , but since those are user-visible strings
    so it was not modified.
    
    Signed-off-by: Sudip Mukherjee <[email protected]>
    Tested-by: Benjamin Romer <[email protected]>
    Acked-by: Benjamin Romer <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 635ecc5f36438cdf8cf3b88421321ee7443eb2d1
Author: Luke Hart <[email protected]>
Date:   Fri Sep 12 10:48:33 2014 +0100

    staging: unisys: Fix sparse error - accessing __iomem directly
    
    Copy the channel type into a temporary buffer so that code will work
    for architectures that don't support MMIO. This now works in same way
    as other tests in same function.
    
    Signed-off-by: Luke Hart <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit cec78b98df2f87a396890c802dccbf0e604c6829
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:05 2014 +0100

    staging: et131x: logical continuations should be on the previous line
    
    Fix two occurrences of the checkpatch check:
    
    CHECK: Logical continuations should be on the previous line
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d855b8935e211b285aa6eb3d42e2ea810b03e043
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:04 2014 +0100

    staging: et131x: Fix 'else is not generally useful after a break or return'
    
    Fix this checkpatch warning:
    
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b6cb966074d6863293b774327ca5738bb27a9b3a
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:08 2014 +0100

    staging: et131x: Use variable names instead of types in sizeof
    
    A few calls to sizeof() in et131x.c give the type as a parameter
    - use the equivalent variable name instead.
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ee60c8ec323167a02de357e9d9b44af850052ee3
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:07 2014 +0100

    staging: et131x: Use braces on all arms of if/else statements
    
    In some places in et131x.c, one arm of am if/else statement has braces
    and the other not - put braces on both arms where this happens.
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c13756784a6a16fb5d25585a4058dd6d284fd033
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:06 2014 +0100

    staging: et131x: Remove spaces after casts
    
    In three places in et131x.c, spaces exist after a cast. Remove them.
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 48c8f78914720b39b9de27c6e58134abdf1f1a4c
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:02 2014 +0100

    staging: et131x: Add spinlock definition comments
    
    Checkpatch --strict advises that spinlocks should be described when
    defined, seems a good idea so this change does that.
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0c55fe2018f7f84e3620e85e4b0d5d06274862da
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:01 2014 +0100

    staging: et131x: Remove useless assignment to NULL
    
    The stack variable skb is no longer used after it's set to
    NULL. Don't set it to NULL.
    
    Reported-by: Dan Carpenter <[email protected]>
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit bacb71edb48050b46244a66ec8d49c55a89eec34
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:00 2014 +0100

    staging: et131x: Remove send_hw_lock spinlock
    
    We don't need to use this lock - the tx path is protected by the
    networking subsystem xmit_lock, so we don't also need it in
    nic_send_packet().
    
    The other use of this spinlock in et1310_enable_phy_coma() t…
aryabinin referenced this pull request in aryabinin/linux Sep 24, 2014
@hnaz
linux-next
94a23c7 
GIT 1b28f1c3d6821c20f42c22e977999fffbf0c0331

commit 78cbcabd472b197dc8ae7abd11f197efe611211a
Author: Peter Foley <[email protected]>
Date:   Mon Sep 22 09:31:10 2014 +1000

    Documentation: disable vdso_test to avoid breakage with old glibc
    
    glibc versions older than 2.16 don't include sys/auxv.h which this
    executable uses.
    Since we don't have a good way to test for specific glibc versions in
    kbuild, just disable it for now.
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit c5a967ad6aba3adc9b61f28d799be4fdf815e6bf
Author: Peter Foley <[email protected]>
Date:   Mon Sep 22 09:31:10 2014 +1000

    Documentation: update vDSO makefile to build portable examples
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit dee40f0c69658d15a49a3dbca4f105410f561ad4
Author: Peter Foley <[email protected]>
Date:   Mon Sep 22 09:31:09 2014 +1000

    Documentation: update .gitignore files
    
    Add some missing files to .gitignore.
    Push Documentation/.gitignore down into subdirectories.
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit 7f73b38710908162de63e9c940e1a0c26810dd19
Author: Peter Foley <[email protected]>
Date:   Mon Sep 22 09:31:09 2014 +1000

    Documentation: support glibc versions without htole macros
    
    glibc 2.9 introduced the htole<16/32/64> macros, add them to
    tools/include to support older versions of glibc.
    
    Reported-by: Andrew Morton <[email protected]>
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit c06fccd3288d690700b0d2824485ba925d09abd4
Author: Mark Brown <[email protected]>
Date:   Mon Sep 22 09:31:08 2014 +1000

    v4l2-pci-skeleton: Only build if PCI is available
    
    Currently arm64 does not support PCI but it does support v4l2. Since the
    PCI skeleton driver is built unconditionally as a module with no dependency
    on PCI this causes build failures for arm64 allmodconfig. Fix this by
    defining a symbol VIDEO_PCI_SKELETON for the skeleton and conditionalising
    the build on that.
    
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]> [added VIDEO dependencies]

commit c735483de1a2cd5d6c6b67bf49cfb2991eae6ea6
Author: Helge Deller <[email protected]>
Date:   Sun Sep 21 22:31:08 2014 +0200

    parisc: pdc_stable.c: Avoid potential stack overflows
    
    Signed-off-by: Helge Deller <[email protected]>

commit 94c457deff2a211f8372f69a4d7b0d288183756a
Author: Rickard Strandqvist <[email protected]>
Date:   Sun Sep 14 18:02:12 2014 +0200

    parisc: pdc_stable.c: Cleaning up unnecessary use of memset in conjunction with strncpy
    
    Using memset before strncpy just to ensure a trailing null character is
    an unnecessary double writing of a string
    
    Patch modified by Helge Deller to additionally reduce stack usage.
    
    Signed-off-by: Rickard Strandqvist <[email protected]>
    Signed-off-by: Helge Deller <[email protected]>

commit fe5c873459a973e59854bd235a7e6b3eaa8e5fe0
Author: Helge Deller <[email protected]>
Date:   Sun Sep 21 21:01:15 2014 +0200

    parisc: ptrace: use secure_computing_strict()
    
    Signed-off-by: Helge Deller <[email protected]>

commit 5466112f0935f079e225514905c57d5e5285a9b6
Author: Trond Myklebust <[email protected]>
Date:   Thu Sep 18 17:03:46 2014 -0400

    pnfs/blocklayout: Fix a 64-bit division/remainder issue in bl_map_stripe
    
    kbuild test robot reports:
    
       fs/built-in.o: In function `bl_map_stripe':
       >> :(.text+0x965b4): undefined reference to `__aeabi_uldivmod'
       >> :(.text+0x965cc): undefined reference to `__aeabi_uldivmod'
       >> :(.text+0x96604): undefined reference to `__aeabi_uldivmod'
    
    Fixes: 5c83746a0cf2 (pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing)
    Cc: Stephen Rothwell <[email protected]>
    Cc: Christoph Hellwig <[email protected]>
    Reviewed-by: Christoph Hellwig <[email protected]>
    Signed-off-by: Trond Myklebust <[email protected]>

commit 9c58c79a8a76c510cd3a5012c536d4fe3c81ec3b
Author: Zhihui Zhang <[email protected]>
Date:   Sat Sep 20 21:24:36 2014 -0400

    sched: Clean up some typos and grammatical errors in code/comments
    
    Signed-off-by: Zhihui Zhang <[email protected]>
    Cc: [email protected]
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ingo Molnar <[email protected]>

commit 6a40281ab5c1ed8ba2253857118a5d400a2d084b
Author: Chuck Ebbert <[email protected]>
Date:   Sat Sep 20 10:17:51 2014 -0500

    sched: Fix end_of_stack() and location of stack canary for architectures using CONFIG_STACK_GROWSUP
    
    Aaron Tomlin recently posted patches [1] to enable checking the
    stack canary on every task switch. Looking at the canary code, I
    realized that every arch (except ia64, which adds some space for
    register spill above the stack) shares a definition of
    end_of_stack() that makes it the first long after the
    threadinfo.
    
    For stacks that grow down, this low address is correct because
    the stack starts at the end of the thread area and grows toward
    lower addresses. However, for stacks that grow up, toward higher
    addresses, this is wrong. (The stack actually grows away from
    the canary.) On these archs end_of_stack() should return the
    address of the last long, at the highest possible address for the stack.
    
    [1] http://lkml.org/lkml/2014/9/12/293
    
    Signed-off-by: Chuck Ebbert <[email protected]>
    Link: http://lkml.kernel.org/r/20140920101751.6c5166b6@as
    Signed-off-by: Ingo Molnar <[email protected]>
    Tested-by: James Hogan <[email protected]> [metag]
    Acked-by: James Hogan <[email protected]>
    Acked-by: Aaron Tomlin <[email protected]>

commit 0c7bf3e8cab7900e17ce7f97104c39927d835469
Author: Zefan Li <[email protected]>
Date:   Sat Sep 20 14:49:10 2014 +0800

    cgroup: remove redundant variable in cgroup_mount()
    
    Both pinned_sb and new_sb indicate if a new superblock is needed,
    so we can just remove new_sb.
    
    Note now we must check if kernfs_tryget_sb() returns NULL, because
    when it returns NULL, kernfs_mount() may still re-use an existing
    superblock, which is just allocated by another concurent mount.
    
    Suggested-by: Tejun Heo <[email protected]>
    Signed-off-by: Zefan Li <[email protected]>
    Signed-off-by: Tejun Heo <[email protected]>

commit 3e2cd91ab92665148616a80dc0745c499d2746a7
Author: Zefan Li <[email protected]>
Date:   Sat Sep 20 14:35:43 2014 +0800

    cgroup: fix missing unlock in cgroup_release_agent()
    
    The patch 971ff4935538: "cgroup: use a per-cgroup work for release
    agent" from Sep 18, 2014, leads to the following static checker
    warning:
    
    	kernel/cgroup.c:5310 cgroup_release_agent()
    	warn: 'mutex:&cgroup_mutex' is sometimes locked here and sometimes unlocked.
    
    Reported-by: Dan Carpenter <[email protected]>
    Signed-off-by: Zefan Li <[email protected]>
    Signed-off-by: Tejun Heo <[email protected]>

commit 93b8877471796c04c16fdef755d4e5c0f521509f
Author: Alexander Shiyan <[email protected]>
Date:   Sat Sep 20 09:34:45 2014 +0400

    tty: serial_mctrl_gpio: Fix COMPILE_TEST build for architectures with custom termios.h
    
    This patch fixes COMPILE_TEST build of serial_mctrl_gpio module for
    architectures with custom termios.h header.
    
    sparc64:allmodconfig:
    
    In file included from drivers/tty/serial/serial_mctrl_gpio.c:21:0:
    include/uapi/asm-generic/termios.h:22:8: error: redefinition of 'struct termio'
    ./arch/sparc/include/uapi/asm/termbits.h:16:8: note: originally defined here
    make[3]: *** [drivers/tty/serial/serial_mctrl_gpio.o] Error 1
    
    Reported-by: Guenter Roeck <[email protected]>
    Signed-off-by: Alexander Shiyan <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d07fe967189ff7c32f5a78b4f28c2ccbab850091
Author: Chen-Yu Tsai <[email protected]>
Date:   Thu Sep 18 11:24:40 2014 +0800

    ARM: dts: sun8i: Add DMA controller node
    
    Add the DMA controller node and DMA bindings to the supported devices.
    
    Signed-off-by: Chen-Yu Tsai <[email protected]>
    Signed-off-by: Maxime Ripard <[email protected]>

commit e625305b390790717cf2cccf61efb81299647028
Author: Tejun Heo <[email protected]>
Date:   Sat Sep 20 01:27:25 2014 -0400

    percpu-refcount: make percpu_ref based on longs instead of ints
    
    percpu_ref is currently based on ints and the number of refs it can
    cover is (1 << 31).  This makes it impossible to use a percpu_ref to
    count memory objects or pages on 64bit machines as it may overflow.
    This forces those users to somehow aggregate the references before
    contributing to the percpu_ref which is often cumbersome and sometimes
    challenging to get the same level of performance as using the
    percpu_ref directly.
    
    While using ints for the percpu counters makes them pack tighter on
    64bit machines, the possible gain from using ints instead of longs is
    extremely small compared to the overall gain from per-cpu operation.
    This patch makes percpu_ref based on longs so that it can be used to
    directly count memory objects or pages.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Cc: Kent Overstreet <[email protected]>
    Cc: Johannes Weiner <[email protected]>

commit 4843c3320c3d23ab4ecf520f5eaf485aff8c7252
Author: Tejun Heo <[email protected]>
Date:   Sat Sep 20 01:27:24 2014 -0400

    percpu-refcount: improve WARN messages
    
    percpu_ref's WARN messages can be a lot more helpful by indicating
    who's the culprit.  Make them report the release function that the
    offending percpu-refcount is associated with.  This should make it a
    lot easier to track down the reported invalid refcnting operations.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Cc: Kent Overstreet <[email protected]>

commit 6d967f8789249628a6388a3a4314c5fef423f36a
Author: Andy Zhou <[email protected]>
Date:   Fri Sep 19 18:02:53 2014 -0700

    udp_tunnel: Only build ip6_udp_tunnel.c when IPV6 is selected
    
    Functions supplied in ip6_udp_tunnel.c are only needed when IPV6 is
    selected. When IPV6 is not selected, those functions are stubbed out
    in udp_tunnel.h.
    
    ==================================================================
     net/ipv6/ip6_udp_tunnel.c:15:5: error: redefinition of 'udp_sock_create6'
         int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
     In file included from net/ipv6/ip6_udp_tunnel.c:9:0:
          include/net/udp_tunnel.h:36:19: note: previous definition of 'udp_sock_create6' was here
           static inline int udp_sock_create6(struct net *net, struct udp_port_cfg *cfg,
    ==================================================================
    
    Fixes:  fd384412e udp_tunnel: Seperate ipv6 functions into its own file
    Reported-by: kbuild test robot <[email protected]>
    Signed-off-by: Andy Zhou <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 3f76a4ea5383ba2f9e76f9625f77ff246907a134
Author: Mahati Chamarthy <[email protected]>
Date:   Thu Sep 18 19:27:09 2014 +0530

    Staging: rtl8192e: Fix __constant_htons to htons style warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: __constant_htons should be htons
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 288903f6b91e759b0a813219acd376426cbb8f14
Author: Catalina Mocanu <[email protected]>
Date:   Fri Sep 19 15:55:05 2014 -0700

    staging: iio: cdc: Don't put an else right after a return
    
    This fixes the following checkpatch.pl warning:
    WARNING: else is not generally useful after a break or return.
    
    While at it, remove new line for symmetry with the rest of the code.
    
    Signed-off-by: Catalina Mocanu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0a5fcc6b2efdc86619af793e0216a508469cfaa4
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 23:32:05 2014 +0300

    staging: octeon: Fix quoted string split warning.
    
    This patch fixes "quoted string split across lines" checkpatch.pl
    warning in ethernet.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 39bc7513aa92b38c391dbe9649841f9f9dfcd0ac
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 23:27:39 2014 +0300

    staging: octeon: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    ethernet.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1ff99b312f9c94516acb38bad7421ba1d74abeb2
Author: Roberta Dobrescu <[email protected]>
Date:   Fri Sep 19 23:34:36 2014 +0300

    staging: emxx_udc: Replace __constant_cpu_to_le16 with cpu_to_le16
    
    This fixes the following checkpatch.pl warning:
    WARNING: __constant_cpu_to_le16 should be cpu_to_le16
    Additionally, it removes the space between function name and (.
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 113f5f24c6be6f7d888946320d01b51b81aa213d
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 00:31:44 2014 +0300

    Staging: rtl8821ae: Fix warnings of no space before tabs.
    
    This patch fixes these warning messages found by checkpatch.pl:
    WARNING: please, no space before tabs.
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a45cbb78147e8f57250f1687f5b61470b8343a20
Author: Aybuke Ozdemir <[email protected]>
Date:   Thu Sep 18 23:56:13 2014 +0300

    Staging: rtl8821ae: Fix "foo * bar" warning.
    
    This patch fixes these error messages found by checkpatch.pl:
    ERROR: "foo* bar" should be "foo *bar"
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 34c376fe07342e06f531504b01d3b953962e456c
Author: Aybuke Ozdemir <[email protected]>
Date:   Thu Sep 18 01:03:28 2014 +0300

    Staging: wlan-ng: Fix return in void function warning
    
    This fixes checkpatch.pl warning:
    WARNING: void function return statements are not generally useful
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fcf1b73d08cd15912205f3b259ea81ccfde11970
Author: Aybuke Ozdemir <[email protected]>
Date:   Thu Sep 18 00:54:04 2014 +0300

    Staging: media: cxd2099: Missing a blank line after declarations
    
    Fix checkpatch.pl issues with missing a blank
    line after declarations in cxd2099.c
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c2e91542695270452ea7b5d3266ad0e9b5dc7bdb
Author: Aybuke Ozdemir <[email protected]>
Date:   Wed Sep 17 23:43:15 2014 +0300

    Staging: octeon: Missing a blank line after declarations
    
    Fix checkpatch.pl issues with missing a blank
    line after declarations in ethernet-sgmii.c
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 05fd349b1750d456423538e69c3c1d4d8a10f1c8
Author: Aybuke Ozdemir <[email protected]>
Date:   Wed Sep 17 16:10:36 2014 +0300

    staging: gs_fpgaboot Fix trailing whitespace.
    
    Fix checkpatch.pl issues with trailing
    whitespace in README.
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit de77c125f57a308250cfaec945541fd8abe0e054
Author: Aybuke Ozdemir <[email protected]>
Date:   Wed Sep 17 15:33:25 2014 +0300

    staging: bcm: Fix line over 80 characters
    
    Fix checkpatch.pl issues with
    line over 80 characters in HandleControlPacket.c
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5ad6ae1acfd883d8f4c8998b4e5bc9d4aea7985f
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 01:20:44 2014 +0300

    staging: media: lirc: Fixes missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    lirc_serial.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>.
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a5613fe8967534ce626875fab4bcface70d366b4
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 01:26:03 2014 +0300

    staging: media: lirc: Fixes unnecessary return warning.
    
    This patch fixes "void function return statements are not generally
    useful" checkpatch.pl warning in lirc_zilog.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a17ec4c9fd07d3f4760cc6545b54f8323ea6ccb4
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 01:06:55 2014 +0300

    staging: media: lirc: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    lirc_bt829.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3f8028023c3f6804751a920d97e9c8dffc575cc0
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 01:02:21 2014 +0300

    staging: media: lirc: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    lirc_sasem.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a87ba73ed10266dba8278b2a6b89da597a38092a
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 00:59:11 2014 +0300

    staging: media: lirc: Fix unnecessary return warning.
    
    This patch fixes "void function return statements are not generally
    useful" checkpatch.pl warning in lirc_sasem.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fd8392f3097140a9db7b0903a63635e652b6eb45
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 22:46:57 2014 +0300

    staging: media: lirc: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    lirc_zilog.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3170f3277b1809c19fe4a45914cffa0e09471973
Author: Tina Johnson <[email protected]>
Date:   Wed Sep 17 03:14:52 2014 +0530

    Staging: media: lirc: lirc_imon: Removed unnecessary variable to simplify return variable handling
    
    Variable rc was removed after merging its assignment statement with
    immediately following return statement. Variable retval is not used
    at all other that to return its initial value.Hence replaced retval
    with its initial value in the return statement and removed the variable.
    
    This patch was done using Coccinelle script and the following semantic
    patch was used:
    
    @rule1@
    identifier ret;
    expression e;
    @@
    
    -int ret = 0;
     ... when != ret
    (
    -ret = e;
    +return e;
    -return ret;
    |
    -return ret;
    +return 0;
    )
    
    Signed-off-by: Tina Johnson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 8ad5360ad81a32b4e9fdc956e7c453308050a97d
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 21:39:46 2014 +0300

    staging: lustre: lnet: lnet: Fixed quoted string split warning.
    
    This patch fixes "quoted string split across lines" checkpatch.pl
    warning in api-ni.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 70b694c32e405cff8e2640b3943ed9598d97f75e
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 21:48:00 2014 +0300

    staging: lustre: lnet: lnet: Fix missing line warning.
    
    This patch fixes "Fixes "Missing a blank line after declarations"
    checkpatch.pl warning in api-ni.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a446b47d5d815865c2715da8fab1a7c06f1338ca
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 21:53:31 2014 +0300

    staging: lustre: lnet: lnet: Fix quoted string split warning.
    
    This patch fixes "quoted string split across lines" checkpatch.pl
    warning in lib-eq.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3e9cc5b0450a40be3442a82a5a5293f85ca06c7d
Author: Darshana Padmadas <[email protected]>
Date:   Wed Sep 17 20:58:43 2014 +0530

    Staging: lustre: Fix return in void function warning
    
    This fixes checkpatch.pl warning:
    
    WARNING: void function return statements are not generally useful
    
    Signed-off-by: Darshana Padmadas <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6606a77f92821f8bfd4b1b6ba296da662fecb640
Author: Darshana Padmadas <[email protected]>
Date:   Wed Sep 17 20:28:54 2014 +0530

    Staging: lustre: place open brace following struct on same line
    
    This patch fixes checkpatch.pl warning:
    
    WARNING: open brace following struct goes on the same line.
    
    Signed-off-by: Darshana Padmadas <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 4467a945fc08c0d6624b1dd64cfcc2cbd3b3dee3
Author: Darshana Padmadas <[email protected]>
Date:   Wed Sep 17 18:14:45 2014 +0530

    Staging: lustre: libcfs: fix checkpatch warning else after return statement
    
    Fix checkpatch warning by removing unnecessary else after return statement.
    
    Signed-off-by: Darshana Padmadas <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f5740b2e7e74fa9ba915aa74bfba7cf849dce8a7
Author: Darshana Padmadas <[email protected]>
Date:   Tue Sep 16 13:24:13 2014 +0530

    Staging: lustre: include: libcfs: removed else before return statement in libcfs_crypto.h
    
    This is a patch to libcfs_crypto.h that fixes warning on unnecessary else before return statement found by checkpatch.pl tool.
    
    Signed-off-by: Darshana Padmadas <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 225557bf274ed1519362865815da7425533191d1
Author: Roxana Blaj <[email protected]>
Date:   Mon Sep 15 14:58:44 2014 +0300

    staging: speakup: fix checkpatch warning
    
    This fixes the checkpatch warning:
    WARNING: line over 80 characters
    
    Signed-off-by: Roxana Blaj <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0a3a725adb2c421ea79089ea12004a007fb371ce
Author: Roxana Blaj <[email protected]>
Date:   Sun Sep 14 20:28:53 2014 +0300

    staging: speakup: fix checkpatch warning
    
    This fixes the cheackpatch warning:
    WARNING: Missing a blank line after declarations
    
    Signed-off-by: Roxana Blaj <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 472fe30efd52fde30249a04971a62151e0606c1d
Author: Nicoleta Birsan <[email protected]>
Date:   Sun Sep 14 03:38:34 2014 -0700

    Staging: speakup: fix checkpatch warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: Missing a blank line after declarations
    
    Signed-off-by: Nicoleta Birsan <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 297cbdaeca2b68aaae6bbb7affa4533430e8e91a
Author: Blaj Roxana <[email protected]>
Date:   Tue Sep 16 20:13:28 2014 +0300

    staging: skein: replace spaces with tabs
    
    This fixes the error and warning:
    ERROR: code indent should use tabs where possible
    WARNING: please, no spaces at the start of a line
    
    Signed-off-by: Blaj Roxana <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fb33aa47a00edc789d17d80174cd3ed8a1c82c66
Author: Roberta Dobrescu <[email protected]>
Date:   Sat Sep 20 00:01:39 2014 +0300

    staging: dgnc: Check sscanf return value
    
    This fixes the following checkpatch.pl warnings:
    WARNING: unchecked sscanf return value
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f23e875fd26a05a0850db7c5e090030c80b4f583
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 19:34:45 2014 +0300

    staging: dgnc: Fix unnecessary space warning.
    
    Fixed "Unnecessary space before function pointer argument" checkpatch.pl
    warning in dgnc_driver.h
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e8756d4a51d1246be36c5621827c288eb2d5e9b7
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 19:31:15 2014 +0300

    staging: dgnc: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    dgnc_sysfs.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3dfe7557809e5867306c7a0614b9d1c6036cbe4d
Author: Vaishali Thakkar <[email protected]>
Date:   Fri Sep 19 10:30:59 2014 +0530

    Staging: dgnc: Merge lines and remove unused variable for immediate return
    
    This patch merges two lines in a single line if immediate
    return is found. It also removes unnecessory variable rc
    as it is no longer needed.
    
    This is done using Coccinelle. Semantic patch used for this
    is as follows:
    
    @@
    type T;
    identifier i;
    identifier f;
    constant C;
    @@
    - T i;
      ...when != i
         when strict
    (
      return -C;
    |
    - i =
    + return
         f(...);
    - return i;
    )
    
    Signed-off-by: Vaishali Thakkar <[email protected]>
    Reviewed-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 10352c2a69f4aa2724f007a4922518c9ece7bf89
Author: Roberta Dobrescu <[email protected]>
Date:   Thu Sep 18 21:38:04 2014 +0300

    staging: dgnc: Move open brace on previous line
    
    This fixes the following checkpatch.pl errors:
    ERROR: that open brace { should be on the previous line
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 05a70e14035438e6866d7fcf8a79c67b8e1425e1
Author: Roberta Dobrescu <[email protected]>
Date:   Tue Sep 16 20:33:03 2014 +0300

    staging: dgnc: Do not initialise statics to 0 or NULL
    
    This fixes the following checkpatch.pl error:
    ERROR: do not initialise statics to 0 or NULL
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Acked-by: Daniel Baluta <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b051017fb4e593998fc46ec9a991ad390c9114b5
Author: Roberta Dobrescu <[email protected]>
Date:   Mon Sep 15 21:32:59 2014 +0300

    staging: dgnc: Replace kzalloc with kcalloc
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Prefer kcalloc over kzalloc with multiply
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f3dadd29f7197d93d0441391f5e3815bf008cce1
Author: Roberta Dobrescu <[email protected]>
Date:   Sun Sep 14 23:13:20 2014 +0300

    staging: dgnc: Fix warnings relating to printk()
    
    This fixes the following checkpatch.pl warnings:
    WARNING: printk() should include KERN_ facility level
    It replaces printk() with dev_dbg() in order to avoid the warning that a more
    specific function should be used.
    
    Signed-off-by: Roberta Dobrescu <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 2be13f7b7c63cecc439876c8c06a5b30afdf46f9
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 04:59:59 2014 +0530

    Staging: rtl8192ee: rtl8192ee: Fix missing blank line warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Missing a blank line after declarations
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b9209a93edbccafb6c2f860bc0ddfe9eda1e3ccd
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 04:49:43 2014 +0530

    Staging: rtl8192ee: Fix else not useful style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1709a582e1f8977de040f02d9e9e52ec89f8603f
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 04:03:36 2014 +0530

    Staging: rtl8192ee: Fix break is not useful warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: break is not useful after a goto or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fe6dc85eaf8bb180ad3510a57bd69f3b8f9c2dbb
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 03:42:01 2014 +0530

    Staging: rtl8192ee: Fix else is not useful warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f41788b7c933127863435f72f456ec46ed5540b2
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 03:29:19 2014 +0530

    Staging: rtl8192ee: Fix missing blank line warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Missing a blank line after declarations
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ad39fe743419d58f9bc29373189c93ba2251e675
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 02:43:26 2014 +0530

    Staging: rtl8192e: Fix printk debug style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Prefer [subsystem eg: netdev]_dbg([subsystem]dev, ... then dev_dbg(dev,
     ... then pr_debug(...  to printk(KERN_DEBUG ...
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 4344672830d8500eac97d82976b03e41580c3a04
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 02:40:43 2014 +0530

    Staging: rtl8192e: Fix printk style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Prefer [subsystem eg: netdev]_info([subsystem]dev, ... then dev_info(dev, ... then pr_info(...  to printk(KERN_INFO ...
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6af197672f2330045c171aed3ea90fb93d89ecc6
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 02:38:39 2014 +0530

    Staging: rtl8192e: Fix space before semicolon warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: space prohibited before semicolon
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 13402f7b76223e7f50ab42c82aac4788940c8277
Author: Mahati Chamarthy <[email protected]>
Date:   Sat Sep 20 02:36:31 2014 +0530

    Staging: rtl8192e: Fix else is not useful warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5110e40260d03fdb2d93a94fec06a31b81d57b0b
Author: Mahati Chamarthy <[email protected]>
Date:   Fri Sep 19 23:56:02 2014 +0530

    Staging: rtl8192e: Fix void function return statements style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING:  void function return statements are not generally useful
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 59422a74b55c616d500c3be721077ff0d00f7fb0
Author: Mahati Chamarthy <[email protected]>
Date:   Fri Sep 19 23:12:53 2014 +0530

    Staging: rtl8192e: Fix else is not useful style warning
    
    This fixes the following checkpatch.pl warnings:
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1f921b9f61b1a324366c8f6a02c5a8e89164ed52
Author: Vaishali Thakkar <[email protected]>
Date:   Fri Sep 19 22:22:19 2014 +0530

    Staging: rtl8192e: Fixed style warning relating to printk()
    
    This patch fixes following checkpatch.pl warning in file rtl_dm.c:
    
    WARNING: Prefer [subsystem eg: netdev]_info([subsystem]dev, ... then dev_info(dev, ... then pr_info(...  to printk(KERN_INFO .
    
    Signed-off-by: Vaishali Thakkar <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 52e93b8ab435978bc12280aa4418ef25fd6e74f2
Author: Mahati Chamarthy <[email protected]>
Date:   Fri Sep 19 05:22:33 2014 +0530

    Staging: rtl8192e: Fix unnecessary parentheses style warning
    
    This fixes the following checkpatch.pl warning:
    WARNING: Unnecessary parentheses - maybe == should be = ?
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fee9d3e61d04422628a3d22ed5eb8370dcef259b
Author: Chris J Arges <[email protected]>
Date:   Wed Aug 27 13:26:53 2014 -0500

    ktest: add ability to skip during BISECT_MANUAL
    
    When doing a manual bisect, a build can fail or a test can be inconclusive.
    In these cases it would be helpful to be able to skip the test entirely.
    
    Link: http://lkml.kernel.org/r/[email protected]
    
    Reviewed-by: Satoru Takeuchi <[email protected]>
    Signed-off-by: Chris J Arges <[email protected]>
    Signed-off-by: Steven Rostedt <[email protected]>

commit 4af409f6c38029e1eda0a5e7bbf15e9b1b7d7fab
Author: Benedict Boerger <[email protected]>
Date:   Thu Sep 18 17:46:23 2014 +0200

    staging: rtl8192u: delete unused function CAM_read_entry
    
    Fix the sparse warning: symbol 'CAM_read_entry' was not declared. Should it be static?
    
    The function CAM_read_entry is not used and therefore deleted.
    
    Signed-off-by: Benedict Boerger <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 77baad9e4d71e75d7ad6ee83454113d4a6a7b04d
Author: Ragnar B. Johannsson <[email protected]>
Date:   Thu Sep 18 14:33:25 2014 +0000

    staging: rtl8192u: Move ieee80211_crypto_* declarations to ieee80211/ieee80211.h
    
    Move ieee80211_crypto*_init and _exit prototype declarations from r8192U_core.c to ieee80211/ieee80211.h. This fixes the following sparse warnings:
    
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.c:203:12: warning: symbol 'ieee80211_crypto_init' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt.c:223:13: warning: symbol 'ieee80211_crypto_deinit' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c:764:12: warning: symbol 'ieee80211_crypto_tkip_init' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_tkip.c:769:13: warning: symbol 'ieee80211_crypto_tkip_exit' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c:467:12: warning: symbol 'ieee80211_crypto_ccmp_init' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c:472:13: warning: symbol 'ieee80211_crypto_ccmp_exit' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c:281:12: warning: symbol 'ieee80211_crypto_wep_init' was not declared. Should it be static?
    drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_wep.c:286:13: warning: symbol 'ieee80211_crypto_wep_exit' was not declared. Should it be static?
    
    Signed-off-by: Ragnar B. Johannsson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5635b82a553620c511dc6bc8cb0990c0a791e21e
Author: Mahati Chamarthy <[email protected]>
Date:   Thu Sep 18 15:43:53 2014 +0530

    Staging: rtl8192e: Fix style warnings relating to printk(KERN_DEBUG
    
    This fixes the following checkpatch.pl warnings:
    WARNING: Prefer [subsystem eg: netdev]_dbg([subsystem]dev, ... then dev_dbg(dev, ... then pr_debug(...  to printk(KERN_DEBUG ...
    
    Signed-off-by: Mahati Chamarthy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fe40a0b361de10ea794116160308cc7fd0b7fbeb
Author: Vaishali Thakkar <[email protected]>
Date:   Wed Sep 17 08:35:24 2014 +0530

    Staging: rtl8192e: rtl8192e: Remove unnecessory braces and space
    
    This patch removes following checkpatch.pl warnings in rtl_core.c file:
    
    WARNING: Braces {} are not necessary for single statement blocks
    WARNING: Space prohibited before semicolon
    
    Signed-off-by: Vaishali Thakkar <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5c8b3961da9a55762ea5481e8f9412c0d18dc684
Author: Vaishali Thakkar <[email protected]>
Date:   Wed Sep 17 08:02:43 2014 +0530

    Staging: rtl8192e: rtl8192e: Remove unnecessory variable
    
    This patch removes unnecessory variable in file ret_core.c
    using coccinelle script.Semantic patch for this is as follows:
    
    @@
    identifier ret;
    @@
    
    -int ret = 0;
     ... when != ret
         when strict
    -return ret;
    +return 0;
    
    Signed-off-by: Vaishali Thakkar <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 23a0e1611b880bd8d94bbebcb3577c9f78029435
Author: Steven Rostedt (Red Hat) <[email protected]>
Date:   Fri Sep 19 20:10:39 2014 -0400

    ktest: Add PATCHCHECK_CHERRY
    
    Add a way to run a patchcheck test on the commits that are in one branch
    but not in another. This uses git cherry to find a list of commits to
    test each one with.
    
    Signed-off-by: Steven Rostedt <[email protected]>

commit 4309635f692192ddcc540964189d92cad0ade249
Author: Rajbinder Brar <[email protected]>
Date:   Tue Sep 16 11:25:31 2014 +0530

    Staging: vt6655: Break 80 character long line to remove checkpatch error
    
    This removes checkpatch.pl warning
    WARNING: line over 80 characters
    
    Signed-off-by: Rajbinder Brar <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b377ed4cce004d7c3dbd92cffdbf2aa21d28e2e6
Author: Rajbinder Brar <[email protected]>
Date:   Wed Sep 17 21:27:03 2014 +0530

    Staging: vt6656: Removing else after break statement to fix warning
    
    This patch fixes the checkpatch.pl warning in baseband.c file
    WARNING: else is not useful after a break or return
    
    Signed-off-by: Rajbinder Brar <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit dbc6ee63d4355a51fd84ee8ebf127763180b1585
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 19:49:33 2014 +0300

    Staging: vt6655: Fix C99 style commenting.
    
    This patch fixes these error messages found by checkpatch.pl:
    ERROR: do not use C99 // comments
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a600f4589fdbb51a0ad885408f996ec0f1f90be9
Author: Abel Moyo <[email protected]>
Date:   Thu Sep 18 21:49:10 2014 +0200

    Staging: gdm724x: gdm_usb: added error checking in do_tx()
    
    Added error checking for alloc_tx_struct in do_tx()
    
    Signed-off-by: Abel Moyo <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 37d963fb80d2fd944bd0124570b2adc5b826ccef
Author: Gulsah Kose <[email protected]>
Date:   Sat Sep 20 20:43:53 2014 +0300

    staging: gdm724x: Fix missing blank line warning.
    
    Fixes "Missing a blank line after declarations" checkpatch.pl warning in
    gdm_mux.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 492a1e7be585c88a04ba763bb77fc865700e209d
Author: Daeseok Youn <[email protected]>
Date:   Tue Sep 16 16:19:06 2014 +0900

    staging: dgap: use schedule_timeout_interruptible() instead of dgap_ms_sleep()
    
    Using schedule_timeout_interruptible() is exactly same as
    setting a status of current process and calling  schedule_timeout().
    
    Removes dgap_ms_sleep(), because this function is used
    only when closing tty channel on dgap_tty_close().
    And also removes ch_close_delay that is always set to 250
    on dgap_tty_init().
    
    Signed-off-by: Daeseok Youn <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 335d9c85be096cf492cb3eaeef160b45e1f25d8d
Author: Ankita Patil <[email protected]>
Date:   Thu Sep 18 12:31:00 2014 +0530

    Staging: dgap: Remove unnecessary variable.
    
    This patch removes unnecessary variable in file dgap.c
    using Coccinelle. Semantic patch for this is as follows:
    
    @@
    expression ret;
    identifier f;
    @@
    
    -ret =
    +return
         f(...);
    -return ret;
    
    Also removed the unneeded variable manually.
    
    Signed-off-by: Ankita Patil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 50d0a21b61f22b38f881fa21d2ada6ab4a61f93f
Author: Purnendu Kapadia <[email protected]>
Date:   Mon Sep 15 13:06:36 2014 +0100

    staging: android: sw_sync: checkpatch fixes
    
       - no space after cast
       - allignment should match open parenthesis
       - remove unnecessary new line
    
    Signed-off-by: Purnendu Kapadia <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1f0f6c9862b687db36f5e853402f76bc118ff0bf
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 01:58:29 2014 +0300

    Staging: rtl8723au: hal: Space prohibited before semicolon
    
    This patch fixes these warning messages found by checkpatch.pl:
    WARNING: Space prohibited before semicolon.
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 8c09757d91703ccbf0da9fc67764de9714c9e615
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 02:23:53 2014 +0300

    Staging: rtl8723au: core: Fix unnecassary braces warning.
    
    This patch fixes these warning messages found by checkpatch.pl:
    WARNING: braces {} are not necessary for single statement blocks
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 867ce1bd68fb1eadb70b82bcda1e451b27ff824a
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 02:33:38 2014 +0300

    Staging: rtl8723au: core: Fix "foo * bar" warning.
    
    This patch fixes these error messages found by checkpatch.pl:
    ERROR: "foo* bar" should be "foo *bar"
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c895a5df852ca9bbac1dee413747303a61aa4ebd
Author: Greg Donald <[email protected]>
Date:   Tue Sep 16 18:37:41 2014 -0500

    drivers: staging: rtl8723au: Fix "space required after that ','" errors
    
    Fix checkpatch.pl "space required after that ','" errors
    
    Signed-off-by: Greg Donald <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f78c0710cd60cd108d436490955909983f309c62
Author: Kieron Browne <[email protected]>
Date:   Tue Sep 16 23:28:09 2014 +0100

    staging: rtl8723au: fix sparse incorrect type assignment warnings
    
    Use cpu_to_le16 to cast int for assignment to __le16 members
    
    Signed-off-by: Kieron Browne <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit adabff85c9486c09ec700d835328e18ccfc9abf0
Author: MihaelaGaman <[email protected]>
Date:   Sun Sep 14 12:56:43 2014 +0300

    staging: rtl8723au: Fix checkpatch errors
    
    Fix checkpatch.pl "spaces required around":
    >, =, =, =, =, +=, >, >, <, <, :, <  errors.
    
    Signed-off-by: MihaelaGaman <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1703c17b8a02b7d1dd3080c4ce9d41a83e95a071
Author: Vaishali Thakkar <[email protected]>
Date:   Sun Sep 14 13:46:37 2014 +0530

    Staging: rtl8188eu: os_dep: Compression of lines for immediate return
    
    This patch compresses two lines in to a single line in file rtw_android.c
    if immediate return statement is found. It also removes variable bytes_written as
    it is no longer needed.
    
    It is done using script Coccinelle. And coccinelle uses following semantic
    patch for this compression function:
    
    @@
    expression ret;
    identifier f;
    @@
    
    -ret =
    +return
         f(...);
    -return ret;
    
    Signed-off-by: Vaishali Thakkar<[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 16e614e85025d69c87e9ce80b9e1b5238f0f4479
Author: Gulsah Kose <[email protected]>
Date:   Sun Sep 21 00:13:29 2014 +0300

    staging: rtl8188eu: core: Fixed wrong space error.
    
    This patch fixes "foo     * bar" should be "foo   *bar" checkpatch.pl error in rtw_cmd.c
    
    Signed-off-by: Gulsah Kose <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 69869c01ff148ef22d0ea1adec27b4543789792b
Author: Catalina Mocanu <[email protected]>
Date:   Fri Sep 19 14:54:54 2014 -0700

    staging: iio: impedance-analyzer: add blank line after declaration
    
    This fixes the following checkpatch.pl warning:
    WARNING: Missing a blank line after declarations.
    
    Signed-off-by: Catalina Mocanu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 714ab9bdd350413f48ad401bd25e11b3e9f257ab
Author: Catalina Mocanu <[email protected]>
Date:   Fri Sep 19 14:32:09 2014 -0700

    staging: iio: trigger: add blank lines after declarations
    
    This fixes the following checkpatch.pl warning:
    WARNING: Missing a blank line after declarations.
    
    Signed-off-by: Catalina Mocanu <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 8a689c114796d8a3801c2bf3e25d3e21d6816036
Author: Aybuke Ozdemir <[email protected]>
Date:   Fri Sep 19 18:48:05 2014 +0300

    Staging: iio: resolver: Missing a blank line after declarations
    
    This patch fixes these warning messages found by checkpatch.pl:
    WARNING : Missing a blank line after declarations
    
    Signed-off-by: Aybuke Ozdemir <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 4b4c727519b510ab9d9b33de51ea41fc34b9ef27
Author: Catalina Mocanu <[email protected]>
Date:   Thu Sep 18 14:55:06 2014 -0700

    staging: iio: dummy: add blank lines after declarations.
    
    This fixes the following checkpatch.pl warning:
    WARNING: Missing a blank line after declarations.
    
    Signed-off-by: Catalina Mocanu <[email protected]>
    Reviewed-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b581c3d9a90772613e05e659b4e8defc81704212
Author: Tina Johnson <[email protected]>
Date:   Sat Sep 13 15:46:15 2014 +0530

    Staging: iio: meter: ade7753: Fixed checkpatch.pl warnings
    
    Clean-up patch to fix the following checkpatch.pl warnings:
    
    ade7753.c:325: WARNING: Missing a blank line after declarations
    ade7753.c:383: WARNING: Missing a blank line after declarations
    
    Signed-off-by: Tina Johnson<[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 9034720a54738bbaf96b619f34f887199ac7efed
Author: Tina Johnson <[email protected]>
Date:   Sun Sep 14 16:30:05 2014 +0530

    Staging: iio: meter: ade7753: Merged assignment with immediately following return statement
    
    Saved one line of code by merging the assigning and return statements
    of variable ret. And thus removed variable len which was no longer useful.
    
    This patch was done using Coccinelle script and the following semantic
    patch was used:
    
    @@
    expression ret;
    identifier f;
    @@
    
    -ret =
    +return
          f(...);
    -return ret;
    
    Signed-off-by: Tina Johnson <[email protected]>
    Acked-by: Julia Lawall <[email protected]>
    Acked-by: Josh Triplett <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 18f340f90e087c078c634d5c4fed5e0d632d4fb6
Author: Paul Zimmerman <[email protected]>
Date:   Fri Sep 19 14:49:36 2014 -0700

    usb: dwc2: add T: line to MAINTAINERS showing Felipe's tree
    
    Starting with v3.18-rc, patches for dwc2 will go through Felipe's
    tree. Add a T: line to MAINTAINERS to document this.
    
    Signed-off-by: Paul Zimmerman <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5dce95554a1866339de039060ecd7122056a9d71
Author: Paul Zimmerman <[email protected]>
Date:   Tue Sep 16 13:47:27 2014 -0700

    usb: dwc2: handle DMA buffer unmapping sanely
    
    The driver's handling of DMA buffers for non-aligned transfers
    was kind of nuts. For IN transfers, it left the URB DMA buffer
    mapped until the transfer completed, then synced it, copied the
    data from the bounce buffer, then synced it again.
    
    Instead of that, just call usb_hcd_unmap_urb_for_dma() to unmap
    the buffer before starting the transfer. Then no syncing is
    required when doing the copy. This should also allow handling of
    other types of mappings besides just dma_map_single() ones.
    
    Also reduce the size of the bounce buffer allocation for Isoc
    endpoints to 3K, since that's the largest possible transfer size.
    
    Tested on Raspberry Pi and Altera SOCFPGA.
    
    Signed-off-by: Paul Zimmerman <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e8f8c14d9da7ab1b8a7b0f769cd7148ca2cc7d10
Author: Paul Zimmerman <[email protected]>
Date:   Tue Sep 16 13:47:26 2014 -0700

    usb: dwc2: clip max_transfer_size to 65535
    
    Clip max_transfer_size to 65535 for host. dwc2_hc_setup_align_buf()
    allocates coherent buffers with this size, and if it's too large we
    can exhaust the coherent DMA pool.
    
    Tested on Raspberry Pi and Altera SOCFPGA.
    
    Signed-off-by: Paul Zimmerman <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d00b41428042e72d9dc2557d9147434a4e3d631f
Author: Robert Baldyga <[email protected]>
Date:   Tue Sep 9 10:44:57 2014 +0200

    usb: dwc2/gadget: disable clock when it's not needed
    
    When device is stopped or suspended clock is not needed so we
    can disable it for this time.
    
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b203d0a2e32dd28e87780078f0789322862e4da8
Author: Robert Baldyga <[email protected]>
Date:   Tue Sep 9 10:44:56 2014 +0200

    usb: dwc2/gadget: assign TX FIFO dynamically
    
    Because we have not enough memory to have each TX FIFO of size at least
    3072 bytes (the maximum single packet size with 3 transactions per
    microframe), we create four FIFOs of lenght 1024, and four of length
    3072 bytes, and assing them to endpoints dynamically according to
    maxpacket size value of given endpoint.
    
    Up to now there were initialized 16 TX FIFOs, but we use only 8 IN
    endpoints, so we can split available memory for 8 FIFOs to have more
    memory for each one.
    
    It needed to do some small modifications in few places in code, because
    there was assumption that TX FIFO numbers assigned to endpoints are the
    same as the endpoint numbers, which is not true since we have dynamic
    FIFO assigning.
    
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit cff9eb756e18a7763d7ab9c574c0ab191e712341
Author: Marek Szyprowski <[email protected]>
Date:   Tue Sep 9 10:44:55 2014 +0200

    usb: dwc2/gadget: ensure that all fifos have correct memory buffers
    
    Print warning if FIFOs are configured in such a way that they don't fit
    into the SPRAM available on the s3c hsotg module.
    
    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1e01129373f757925a652ea4ea5b278f8c2b9222
Author: Marek Szyprowski <[email protected]>
Date:   Tue Sep 9 10:44:54 2014 +0200

    usb: dwc2/gadget: hide some not really needed debug messages
    
    Some DWC2/s3c-hsotg debug messages are really useless for typical user,
    so hide them behind dev_dbg().
    
    Signed-off-by: Marek Szyprowski <[email protected]>
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d784f1e50977e58db23a79181971c3c0f62452e5
Author: Andrzej Pietrasiewicz <[email protected]>
Date:   Tue Sep 9 10:44:53 2014 +0200

    usb: dwc2/gadget: Fix comment text
    
    Adjust the debug text to the name of the printed variable.
    
    Signed-off-by: Andrzej Pietrasiewicz <[email protected]>
    Signed-off-by: Robert Baldyga <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 496a51bd64eb15f14cee3519f5b75b28d09567e3
Author: Julia Lawall <[email protected]>
Date:   Thu Sep 18 22:24:02 2014 +0200

    staging: lustre: llite: Use kzalloc and rewrite null tests
    
    This patch removes some kzalloc-related macros and rewrites the
    associated null tests to use !x rather than x == NULL.
    
    A simplified version of the semantic patch that makes this change is as
    follows: (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @@
    expression ptr;
    statement S,S1;
    @@
    
      \(OBD_ALLOC\|OBD_ALLOC_WAIT\|OBD_ALLOC_PTR\|OBD_ALLOC_PTR_WAIT\)(ptr,...);
      if (
    +     !
          ptr
    -      == NULL
         ) S else S1
    
    @@
    expression ptr,size;
    @@
    
    - OBD_ALLOC(ptr,size)
    + ptr = kzalloc(size, GFP_NOFS)
    
    @@
    expression ptr,size;
    @@
    
    - OBD_ALLOC_WAIT(ptr,size)
    + ptr = kzalloc(size, GFP_KERNEL)
    
    @@
    expression ptr,size;
    @@
    
    - OBD_ALLOC_PTR(ptr)
    + ptr = kzalloc(sizeof(*ptr), GFP_NOFS)
    
    @@
    expression ptr,size;
    @@
    
    - OBD_ALLOC_PTR_WAIT(ptr,size)
    + ptr = kzalloc(sizeof(*ptr), GFP_KERNEL)
    // </smpl>
    
    Signed-off-by: Julia Lawall <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit cdbcd3305293d18f7ae73b2766699bddf634bb06
Author: Martin Kelly <[email protected]>
Date:   Mon Sep 15 21:16:15 2014 -0700

    Staging/bcm: Fix whitespace/comments in Ioctl.h
    
    Cleanup whitespace and comments in Ioctl.h in a few ways:
    - > 80 character cleanup
    - Comment clarification
    - More consistent vertical alignment
    
    Signed-off-by: Martin Kelly <[email protected]>
    Reviewed-by: Matthias Beyer <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 33b443e467f6c92c4cc797f5acf6a933fcfe9ec3
Author: Fabien Malfoy <[email protected]>
Date:   Mon Sep 15 09:02:36 2014 +0200

    staging: rtl8821ae: Remove space after unary operator in efuse.c
    
    Several pointer declaration syntax have been fixed to match the coding style.
    
    Signed-off-by: Fabien Malfoy <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c24cdca05edb9c5435529afa37ce8c9c25ac4c5e
Author: Merlin Chlosta <[email protected]>
Date:   Mon Sep 15 01:56:10 2014 +0200

    staging: rtl8192u: sparse warnings: declare ieee80211_TURBO_Info static
    
    Declare ieee80211_TURBO_Info static to fix a sparse "symbol was not declared" warning.
    
    Signed-off-by: Merlin Chlosta <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 5b1ebbffc0b2dd47a45380ba68da36f792a2977e
Author: Vincenzo Scotti <[email protected]>
Date:   Sat Sep 13 13:39:20 2014 +0200

    staging: emxx_udc: fix compile warnings: discarding const qualifier
    
    Signed-off-by: Vincenzo Scotti <[email protected]>
    Reported-by: kbuild test robot <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f02935c575cb00f2a164282866324816a1f52fc1
Author: Masanari Iida <[email protected]>
Date:   Sat Sep 13 01:14:30 2014 +0900

    staging: exxx_udc: Convert pr_warning to pr_warn
    
    This patch Convert pr_warning to pr_warn.
    
    Signed-off-by: Masanari Iida <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3aa2ec581903747d926765850212278c7c24be77
Author: Sudip Mukherjee <[email protected]>
Date:   Fri Sep 12 17:57:26 2014 +0530

    staging: unisys: uislib: uislib.c: sparse warning of context imbalance
    
    fixed sparse warning : context imbalance in 'destroy_device'
                            unexpected unlock
    this patch will generate warning from checkpatch for
    lines over 80 character , but since those are user-visible strings
    so it was not modified.
    
    Signed-off-by: Sudip Mukherjee <[email protected]>
    Tested-by: Benjamin Romer <[email protected]>
    Acked-by: Benjamin Romer <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 635ecc5f36438cdf8cf3b88421321ee7443eb2d1
Author: Luke Hart <[email protected]>
Date:   Fri Sep 12 10:48:33 2014 +0100

    staging: unisys: Fix sparse error - accessing __iomem directly
    
    Copy the channel type into a temporary buffer so that code will work
    for architectures that don't support MMIO. This now works in same way
    as other tests in same function.
    
    Signed-off-by: Luke Hart <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit cec78b98df2f87a396890c802dccbf0e604c6829
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:05 2014 +0100

    staging: et131x: logical continuations should be on the previous line
    
    Fix two occurrences of the checkpatch check:
    
    CHECK: Logical continuations should be on the previous line
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit d855b8935e211b285aa6eb3d42e2ea810b03e043
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:04 2014 +0100

    staging: et131x: Fix 'else is not generally useful after a break or return'
    
    Fix this checkpatch warning:
    
    WARNING: else is not generally useful after a break or return
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b6cb966074d6863293b774327ca5738bb27a9b3a
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:08 2014 +0100

    staging: et131x: Use variable names instead of types in sizeof
    
    A few calls to sizeof() in et131x.c give the type as a parameter
    - use the equivalent variable name instead.
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ee60c8ec323167a02de357e9d9b44af850052ee3
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:07 2014 +0100

    staging: et131x: Use braces on all arms of if/else statements
    
    In some places in et131x.c, one arm of am if/else statement has braces
    and the other not - put braces on both arms where this happens.
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c13756784a6a16fb5d25585a4058dd6d284fd033
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:06 2014 +0100

    staging: et131x: Remove spaces after casts
    
    In three places in et131x.c, spaces exist after a cast. Remove them.
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 48c8f78914720b39b9de27c6e58134abdf1f1a4c
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:02 2014 +0100

    staging: et131x: Add spinlock definition comments
    
    Checkpatch --strict advises that spinlocks should be described when
    defined, seems a good idea so this change does that.
    
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0c55fe2018f7f84e3620e85e4b0d5d06274862da
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:01 2014 +0100

    staging: et131x: Remove useless assignment to NULL
    
    The stack variable skb is no longer used after it's set to
    NULL. Don't set it to NULL.
    
    Reported-by: Dan Carpenter <[email protected]>
    Signed-off-by: Mark Einon <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit bacb71edb48050b46244a66ec8d49c55a89eec34
Author: Mark Einon <[email protected]>
Date:   Sun Sep 14 16:59:00 2014 +0100

    staging: et131x: Remove send_hw_lock spinlock
    
    We don't need to use this lock - the tx path is protected by the
    networking subsystem xmit_lock, so we don't also need it in
    nic_send_packet().
    
    The other use of this spinlock in et1310_enable_phy_coma() t…
koct9i referenced this pull request in koct9i/linux Sep 27, 2014
@hnaz
linux-next
3ade1b1 
GIT 2cf50762577a191f2f646e4034cc21f4764d90ab

commit 68c7ed167ef564c83a0022f2d0fe15cbdac0c5a4
Author: Peter Foley <[email protected]>
Date:   Thu Sep 25 10:34:04 2014 +1000

    Documentation: disable vdso_test to avoid breakage with old glibc
    
    glibc versions older than 2.16 don't include sys/auxv.h which this
    executable uses.
    Since we don't have a good way to test for specific glibc versions in
    kbuild, just disable it for now.
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit 03979f1100aca61cf16ac7f3e464d7f11747e86b
Author: Peter Foley <[email protected]>
Date:   Thu Sep 25 10:34:04 2014 +1000

    Documentation: update vDSO makefile to build portable examples
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit 13770826a9872de445703ee6c05b44f525f78513
Author: Peter Foley <[email protected]>
Date:   Thu Sep 25 10:34:04 2014 +1000

    Documentation: update .gitignore files
    
    Add some missing files to .gitignore.
    Push Documentation/.gitignore down into subdirectories.
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit ce0f3b2691c066255fcf25c77e929ff8cda73417
Author: Peter Foley <[email protected]>
Date:   Thu Sep 25 10:34:03 2014 +1000

    Documentation: support glibc versions without htole macros
    
    glibc 2.9 introduced the htole<16/32/64> macros, add them to
    tools/include to support older versions of glibc.
    
    Reported-by: Andrew Morton <[email protected]>
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit 77cb6d96708f5b681969ce144057ae1ebda96057
Author: Mark Brown <[email protected]>
Date:   Thu Sep 25 10:34:03 2014 +1000

    v4l2-pci-skeleton: Only build if PCI is available
    
    Currently arm64 does not support PCI but it does support v4l2. Since the
    PCI skeleton driver is built unconditionally as a module with no dependency
    on PCI this causes build failures for arm64 allmodconfig. Fix this by
    defining a symbol VIDEO_PCI_SKELETON for the skeleton and conditionalising
    the build on that.
    
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]> [added VIDEO dependencies]

commit 112a45ca901ced590ff71c5fd7d717f8771717ce
Author: Peter Foley <[email protected]>
Date:   Thu Sep 25 10:34:03 2014 +1000

    Documentation: fix misc. warnings
    
    Fix a few warnings that gcc emits during a default build.
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit b0fc375fe2c09477b5effc8e030668203d24c897
Author: Peter Foley <[email protected]>
Date:   Thu Sep 25 10:34:03 2014 +1000

    Documentation: make functions static to avoid prototype warnings
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit 593ed472bcea93949c72ddc45e340fee47a05aa3
Author: Peter Foley <[email protected]>
Date:   Thu Sep 25 10:34:03 2014 +1000

    Documentation: add makefiles for more targets
    
    Add a bunch of previously unbuilt source files to the Documentation build
    machinery.
    
    Signed-off-by: Peter Foley <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit cc67d673f252264535cef654c37c8dd621340e8b
Author: Peter Foley <[email protected]>
Date:   Thu Sep 25 10:34:02 2014 +1000

    Documentation: use subdir-y to avoid unnecessary built-in.o files
    
    Change the Documentation makefiles from obj-m to subdir-y
    to avoid generating unnecessary built-in.o files since nothing
    in Documentation/ is ever linked in to vmlinux.
    
    Signed-off-by: Peter Foley <[email protected]>
    Acked-by: Sam Ravnborg <[email protected]>
    Signed-off-by: Randy Dunlap <[email protected]>

commit bb69afeca345380203c89d2f19e95eca786b5a4c
Author: Peter Foley <[email protected]>
Date:   Thu Sep 25 10:34:02 2014 +1000

    Documentation: remove networking/.gitignore
    
    Remove empty networking/.gitignore
    
    Signed-off-by: Peter Foley <[email protected]>
    Cc: [email protected]
    Cc: [email protected]
    Signed-off-by: Randy Dunlap <[email protected]>

commit 4d96fb1ec81118c6406fe6d3670f172b2faaedf3
Author: Heiko Stuebner <[email protected]>
Date:   Tue Sep 23 22:42:16 2014 +0200

    power: gpio-charger: do not use gpio value directly
    
    Some gpio implementations return interesting values for gpio_get_value when
    the value is not 0 - as seen on a imx6sl board. Therefore do not use the
    value returned from gpio_get_value directly but simply check for 0 or not 0.
    
    Signed-off-by: Heiko Stuebner <[email protected]>
    Reviewed-by: Doug Anderson <[email protected]>
    Tested-by: Doug Anderson <[email protected]>
    Signed-off-by: Sebastian Reichel <[email protected]>

commit ddd26dff757d08d4eb309a28bf2a02372387e71f
Author: Krzysztof Kozlowski <[email protected]>
Date:   Tue Sep 16 18:10:41 2014 +0200

    power: max8925: Use of_get_child_by_name
    
    Use of_get_child_by_name to obtain reference to charger node instead of
    of_find_node_by_name which can walk outside of the parent node.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Signed-off-by: Sebastian Reichel <[email protected]>

commit 920ac5be91bc447c5ef82f457207a169aa79c5f6
Author: Krzysztof Kozlowski <[email protected]>
Date:   Tue Sep 16 18:10:40 2014 +0200

    power: max8925: Fix NULL ptr dereference on memory allocation failure
    
    Check the return value of devm_kzalloc() to fix possible NULL pointer
    dereference and properly exit the probe() on memory allocation failure.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Signed-off-by: Sebastian Reichel <[email protected]>

commit 628ef02c56e515430dd8d8439126dd0ecb8ce8bb
Author: Puthikorn Voravootivat <[email protected]>
Date:   Tue Sep 9 12:20:35 2014 -0700

    bq27x00_battery: Add support to bq27742
    
    Add support to bq27742 in bq27x00 driver. bq27742 register
    addresses are mostly mostly the same as bq27500 addresses
    with minor differences.
    
    Signed-off-by: Puthikorn Voravootivat <[email protected]>
    Reviewed-by: Gwendal Grignou <[email protected]>
    Reviewed-by: Rhyland Klein <[email protected]>
    Reviewed-by: Benson Leung <[email protected]>
    Signed-off-by: Sebastian Reichel <[email protected]>

commit 042e1c79166b9250edd8262bea84e1703f27ad2e
Author: Jin Yao <[email protected]>
Date:   Mon Sep 22 10:31:14 2014 -0700

    Input: soc_button_array - convert to platform bus
    
    ACPI device enumeration mechanism changed a lot since 3.16-rc1.
    ACPI device objects with _HID will be enumerated to platform bus by default.
    For the existing PNP drivers that probe the PNPACPI devices, the device ids
    are listed explicitly in drivers/acpi/acpi_pnp.c.
    But ACPI folks will continue their effort on shrinking this id list by
    converting the PNP drivers to platform drivers, for the devices that don't
    belong to PNP bus in nature.
    
    Signed-off-by: Jin Yao <[email protected]>
    Signed-off-by: Zhang Rui <[email protected]>
    Signed-off-by: Dmitry Torokhov <[email protected]>

commit 3049683eafdbbbd7350b0e5ca02a2d8c026a3362
Author: Marcos Paulo de Souza <[email protected]>
Date:   Wed Sep 24 16:00:33 2014 -0700

    Input: i8042 - fix Asus X450LCP touchpad detection
    
    We need to add this module to the nomux table to be able to detect the
    touchpad.
    
    Cc: stablevger.kernel.org
    Signed-off-by: Marcos Paulo de Souza <[email protected]>
    Signed-off-by: Dmitry Torokhov <[email protected]>

commit 3f3d0463636e38a27c3000d59889b8bdc9072ce1
Author: Javier Martinez Canillas <[email protected]>
Date:   Thu Sep 25 08:23:26 2014 +0900

    ARM: dts: Remove display timings node from exynos5250-snow
    
    Commit a3d72cad63ed ("ARM: dts: Clean up exynos5250-snow")
    improved the Snow DTS but the patch was rebased due conflicting
    changes and the merge resolution added a device node removed by
    commit a98c3c23868f ("ARM: dts: update display related nodes for
    exynos5250-snow").
    
    This patch removes the node again to keep the DTS as before.
    
    Signed-off-by: Javier Martinez Canillas <[email protected]>
    Signed-off-by: Kukjin Kim <[email protected]>

commit dd12ac7fb3988be113465f499ad91b30b8aa4bdd
Author: Javier Martinez Canillas <[email protected]>
Date:   Thu Sep 25 08:21:25 2014 +0900

    ARM: dts: Fix chip select GPIO on exynos5250-smdk5250
    
    Commit 65bbe3fee0e1 ("ARM: dts: Clean up exynos5250-smdk5250")
    improved the smdk5250 DTS but the patch was rebased due conflicting
    changes and the merge resolution added a regression of the bug fixed
    in commit e138d4333aa0 ("ARM: dts: fix the chip select gpios definition
    in the SPI nodes").
    
    This patch fixes the issue by removing the old cs-gpio and using
    the generic cs-gpios property.
    
    Signed-off-by: Javier Martinez Canillas <[email protected]>
    Signed-off-by: Kukjin Kim <[email protected]>

commit 5c4dd348af35a6f6db97b4f2401f74c71f7f3c7d
Author: Rafael J. Wysocki <[email protected]>
Date:   Thu Sep 25 00:53:44 2014 +0200

    Revert "PM / Hibernate: Iterate over set bits instead of PFNs in swsusp_free()"
    
    Revert commit 6efde38f0769 (PM / Hibernate: Iterate over set bits
    instead of PFNs in swsusp_free()) that introduced a NULL pointer
    dereference during system resume from hibernation:
    
    BUG: unable to handle kernel NULL pointer dereference at (null)
    IP: [<ffffffff810a8cc1>] swsusp_free+0x21/0x190
    PGD b39c2067 PUD b39c1067 PMD 0
    Oops: 0000 [#1] SMP
    Modules linked in: <irrelevant list of modules>
    CPU: 1 PID: 4898 Comm: s2disk Tainted: G         C     3.17-rc5-amd64 #1 Debian 3.17~rc5-1~exp1
    Hardware name: LENOVO 2776LEG/2776LEG, BIOS 6EET55WW (3.15 ) 12/19/2011
    task: ffff88023155ea40 ti: ffff8800b3b14000 task.ti: ffff8800b3b14000
    RIP: 0010:[<ffffffff810a8cc1>]  [<ffffffff810a8cc1>]
    swsusp_free+0x21/0x190
    RSP: 0018:ffff8800b3b17ea8  EFLAGS: 00010246
    RAX: 0000000000000000 RBX: ffff8800b39bab00 RCX: 0000000000000001
    RDX: ffff8800b39bab10 RSI: ffff8800b39bab00 RDI: 0000000000000000
    RBP: 0000000000000010 R08: 0000000000000000 R09: 0000000000000000
    R10: ffff8800b39bab10 R11: 0000000000000246 R12: ffffea0000000000
    R13: ffff880232f485a0 R14: ffff88023ac27cd8 R15: ffff880232927590
    FS:  00007f406d83b700(0000) GS:ffff88023bc80000(0000)
    knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000000 CR3: 00000000b3a62000 CR4: 00000000000007e0
    Stack:
     ffff8800b39bab00 0000000000000010 ffff880232927590 ffffffff810acb4a
     ffff8800b39bab00 ffffffff811a955a ffff8800b39bab10 0000000000000000
     ffff88023155f098 ffffffff81a6b8c0 ffff88023155ea40 0000000000000007
    Call Trace:
     [<ffffffff810acb4a>] ? snapshot_release+0x2a/0xb0
     [<ffffffff811a955a>] ? __fput+0xca/0x1d0
     [<ffffffff81080627>] ? task_work_run+0x97/0xd0
     [<ffffffff81012d89>] ? do_notify_resume+0x69/0xa0
     [<ffffffff8151452a>] ? int_signal+0x12/0x17
    Code: 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 41 54 48 8b 05 ba 62 9c 00 49 bc 00 00 00 00 00 ea ff ff 48 8b 3d a1 62 9c 00 55 53 <48> 8b 10 48 89 50 18 48 8b 52 20 48 c7 40 28 00 00 00 00 c7 40
    RIP  [<ffffffff810a8cc1>] swsusp_free+0x21/0x190
     RSP <ffff8800b3b17ea8>
    CR2: 0000000000000000
    ---[ end trace f02be86a1ec0cccb ]---
    
    due to forbidden_pages_map being NULL in swsusp_free().
    
    Fixes: 6efde38f0769 "PM / Hibernate: Iterate over set bits instead of PFNs in swsusp_free()"
    Reported-by: Bjørn Mork <[email protected]>
    Signed-off-by: Rafael J. Wysocki <[email protected]>

commit a928f97152ea39c31f8ea89b60dd30a169d4ed6e
Author: Peter Hüwe <[email protected]>
Date:   Fri Sep 12 21:09:47 2014 +0200

    i2c: acpi: Fix NULL Pointer dereference
    
    If adapter->dev.parent == NULL there is a NULL pointer dereference in
    acpi_i2c_install_space_handler and acpi_i2c_remove_space_handler.
    
    This is present since introduction of this code:
    366047515c6e "i2c: rework kernel config I2C_ACPI" or even
    da3c6647ee08 "I2C/ACPI: Clean up I2C ACPI code and Add CONFIG_I2C_ACPI"
    
    The adapter->dev.parent == NULL case is valid for the i2c_stub,
    so loading i2c_stub with ACPI_I2C_OPREGION enabled results in an oops.
    This is also valid at least for i2c_tiny_usb and i2c_robotfuzz_osif.
    
    Fix by checking whether it is null before calling ACPI_HANDLE.
    
    Signed-off-by: Peter Huewe <[email protected]>
    Acked-by: Mika Westerberg <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit c15d821ddb9dac9ac6b5beb75bf942f3bc3a4004
Author: Srinivas Pandruvada <[email protected]>
Date:   Tue Sep 23 10:35:54 2014 +0800

    gpio / ACPI: Use pin index and bit length
    
    Fix code when the operation region callback is for an gpio, which
    is not at index 0 and for partial pins in a GPIO definition.
    For example:
    Name (GMOD, ResourceTemplate ()
    {
    	//3 Outputs that define the Power mode of the device
    	GpioIo (Exclusive, PullDown, , , , "\\_SB.GPI2") {10, 11, 12}
    	})
    }
    
    If opregion callback calls is for:
    - Set pin 10, then address = 0 and bit length = 1
    - Set pin 11, then address = 1 and bit length = 1
    - Set for both pin 11 and pin 12, then address = 1, bit length = 2
    
    This change requires updated ACPICA gpio operation handler code to
    send the pin index and bit length.
    
    Fixes: 473ed7be0da0 (gpio / ACPI: Add support for ACPI GPIO operation regions)
    Signed-off-by: Srinivas Pandruvada <[email protected]>
    Acked-by: Mika Westerberg <[email protected]>
    Acked-by: Linus Walleij <[email protected]>
    Cc: 3.15+ <[email protected]> # 3.15+: 75ec6e55f138 ACPICA: Update to GPIO region handler interface.
    Signed-off-by: Rafael J. Wysocki <[email protected]>

commit 75ec6e55f1384548311a13ce4fcb39c516053314
Author: Bob Moore <[email protected]>
Date:   Tue Sep 23 10:35:47 2014 +0800

    ACPICA: Update to GPIO region handler interface.
    
    Changes to correct several GPIO issues:
    
    1) The update_rule in a GPIO field definition is now ignored;
    a read-modify-write operation is never performed for GPIO fields.
    (Internally, this means that the field assembly/disassembly
    code is completely bypassed for GPIO.)
    
    2) The Address parameter passed to a GPIO region handler is
    now the bit offset of the field from a previous Connection()
    operator. Thus, it becomes a "Pin Number Index" into the
    Connection() resource descriptor.
    
    3) The bit_width parameter passed to a GPIO region handler is
    now the exact bit width of the GPIO field. Thus, it can be
    interpreted as "number of pins".
    
    Overall, we can now say that the region handler interface
    to GPIO handlers is a raw "bit/pin" addressed interface, not
    a byte-addressed interface like the system_memory handler interface.
    
    Signed-off-by: Bob Moore <[email protected]>
    Signed-off-by: Lv Zheng <[email protected]>
    Cc: 3.15+ <[email protected]> # 3.15+
    Signed-off-by: Rafael J. Wysocki <[email protected]>

commit 457920817e645a7dee42c2a75c81c5ed8e12ee1c
Author: Fu Zhonghui <[email protected]>
Date:   Wed Sep 24 22:42:26 2014 +0200

    ACPI / platform / LPSS: disable async suspend/resume of LPSS devices
    
    On some systems (Asus T100 in particular) there are strict ordering
    dependencies between LPSS devices with respect to power management
    that break if they suspend/resume asynchronously.
    
    In theory it should be possible to follow those dependencies in the
    async suspend/resume case too (the ACPI tables tell as that the
    dependencies are there), but since we're missing infrastructure
    for that at the moment, disable async suspend/resume for all of
    the LPSS devices for the time being.
    
    Link: http://marc.info/?l=linux-acpi&m=141158962321905&w=2
    Fixes: 8ce62f85a81f (ACPI / platform / LPSS: Enable async suspend/resume of LPSS devices)
    Signed-off-by: Li Aubrey <[email protected]>
    Signed-off-by: Fu Zhonghui <[email protected]>
    Cc: 3.16+ <[email protected]> # 3.16+
    [ rjw: Changelog ]
    Signed-off-by: Rafael J. Wysocki <[email protected]>

commit c7da579763f29cf45a861ad4c339aba590d8b80d
Author: Johan Hedberg <[email protected]>
Date:   Wed Sep 24 22:41:46 2014 +0300

    Bluetooth: Add retransmission effort into SCO parameter table
    
    It is expected that new parameter combinations will have the
    retransmission effort value different between some entries (mainly
    because of the new S4 configuration added by HFP 1.7), so it makes sense
    to move it into the table instead of having it hard coded based on the
    selected SCO_AIRMODE_*.
    
    Signed-off-by: Johan Hedberg <[email protected]>
    Signed-off-by: Marcel Holtmann <[email protected]>

commit b2fc3f3c6d397d434174147eca3db1ec778195ce
Author: Olof Johansson <[email protected]>
Date:   Wed Sep 24 11:42:38 2014 -0700

    drivers/soc: ti: fix build break with modules
    
    Fixes below build break by not switching to stubs when the driver is a module:
    
    drivers/soc/ti/knav_dma.c:418:7: error: redefinition of 'knav_dma_open_channel'
     void *knav_dma_open_channel(struct device *dev, const char *name,
           ^
    In file included from drivers/soc/ti/knav_dma.c:26:0:
    include/linux/soc/ti/knav_dma.h:165:21: note: previous definition of 'knav_dma_open_channel' was here
     static inline void *knav_dma_open_channel(struct device *dev, const char *name,
                         ^
    
    Cc: Santosh Shilimkar <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit 2d9251e3501356ceb44444a8f9a393b57163dc6a
Author: Matthias Brugger <[email protected]>
Date:   Mon Aug 18 16:58:00 2014 +0200

    ARM: multi_v7_defconfig: Enable Mediatek platform
    
    Enable Mediatek platform support for multi_v7_defconfig.
    
    Signed-off-by: Matthias Brugger <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit d66820853251e8a9b53125a95a773e482cd79136
Author: Matthias Brugger <[email protected]>
Date:   Mon Aug 18 16:58:00 2014 +0200

    ARM: mediatek: Add earlyprintk support for mt6589
    
    Enable low-level debug for Mediatek mt6589 SoC on UART0.
    
    Signed-off-by: Matthias Brugger <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit 7e9b2828f25ec156623da0c2156604066de5514d
Author: Matthias Brugger <[email protected]>
Date:   Mon Aug 18 16:58:00 2014 +0200

    ARM: dts: mt6589: Change compatible string for GIC
    
    This patch changes the compatible string of the GIC to the
    new "arm,cortex-a7-gic" which does reflect the actual hardware.
    
    Signed-off-by: Matthias Brugger <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit 6e9cb2633698ddadd2493b3793dbc9723f570538
Author: Matthias Brugger <[email protected]>
Date:   Mon Aug 18 16:58:00 2014 +0200

    ARM: dts: mediatek: Add compatible property for aquaris5
    
    Add the missing 'compatible' property to device tree root node of
    
     - mt6589-aquaris5.dts
    
    and document the new values.
    
    Signed-off-by: Matthias Brugger <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit d82df11466df3e0934c7e7aa2f5e08c284e1fd9d
Author: Matthias Brugger <[email protected]>
Date:   Mon Aug 18 16:58:00 2014 +0200

    ARM: dts: mt6589-aquaris5: Add boot argument earlyprintk
    
    Add boot argument for earlyprintk to the aquaris5 device tree file.
    
    Signed-off-by: Matthias Brugger <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit 510f1d72e526e776243397142cbcd459dd2a2efa
Author: Matthias Brugger <[email protected]>
Date:   Mon Aug 18 16:58:00 2014 +0200

    ARM: dts: mt6589: Fix typo in GIC unit address
    
    This changes the unit address of the gic node to it's first register area.
    
    Signed-off-by: Matthias Brugger <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit 995425883e4087a4bfd61d12e442089d1201fc5c
Author: Matthias Brugger <[email protected]>
Date:   Mon Aug 18 16:58:00 2014 +0200

    ARM: dts: Build dtb for Mediatek board
    
    This allows the "make dtbs" to build the aquaris5 dtb for the Mediatek
    SoC.
    
    Signed-off-by: Matthias Brugger <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit 00e978180b1fa211c30642139149ea448ff06c55
Author: Pawel Moll <[email protected]>
Date:   Mon Sep 15 15:33:48 2014 +0100

    bus: arm-ccn: Fix spurious warning message
    
    Because CCN's cycle counter always runs, it will generate
    an interrupt on overflow even if the relevant perf event
    was not requested, causing a spurious warning message.
    
    Fixed now by warning on only normal counter unwanted
    overflows. Also cleaning the overflow mask at init now,
    not to warn on event previously requested by firmware.
    
    Signed-off-by: Pawel Moll <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit 94e57fea62020dbf6e5d0093eabcd28366e86044
Author: Francesco Ruggeri <[email protected]>
Date:   Wed Sep 24 10:12:41 2014 -0700

    PCI: Move PCI_VENDOR_ID_VMWARE to pci_ids.h
    
    Move PCI_VENDOR_ID_VMWARE from device-specific files to pci_ids.h.
    It is useful to always have access to it, especially when accessing
    subsystem_vendor_id on emulated devices.
    
    [bhelgaas: keep pci_ids.h sorted and use lower-case hex]
    Signed-off-by: Francesco Ruggeri <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 17497acbdce9506fd6a75115dee4ab80c3cc5ee5
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:50 2014 -0400

    blk-mq, percpu_ref: start q->mq_usage_counter in atomic mode
    
    blk-mq uses percpu_ref for its usage counter which tracks the number
    of in-flight commands and used to synchronously drain the queue on
    freeze.  percpu_ref shutdown takes measureable wallclock time as it
    involves a sched RCU grace period.  This means that draining a blk-mq
    takes measureable wallclock time.  One would think that this shouldn't
    matter as queue shutdown should be a rare event which takes place
    asynchronously w.r.t. userland.
    
    Unfortunately, SCSI probing involves synchronously setting up and then
    tearing down a lot of request_queues back-to-back for non-existent
    LUNs.  This means that SCSI probing may take above ten seconds when
    scsi-mq is used.
    
      [    0.949892] scsi host0: Virtio SCSI HBA
      [    1.007864] scsi 0:0:0:0: Direct-Access     QEMU     QEMU HARDDISK    1.1. PQ: 0 ANSI: 5
      [    1.021299] scsi 0:0:1:0: Direct-Access     QEMU     QEMU HARDDISK    1.1. PQ: 0 ANSI: 5
      [    1.520356] tsc: Refined TSC clocksource calibration: 2491.910 MHz
    
      <stall>
    
      [   16.186549] sd 0:0:0:0: Attached scsi generic sg0 type 0
      [   16.190478] sd 0:0:1:0: Attached scsi generic sg1 type 0
      [   16.194099] osd: LOADED open-osd 0.2.1
      [   16.203202] sd 0:0:0:0: [sda] 31457280 512-byte logical blocks: (16.1 GB/15.0 GiB)
      [   16.208478] sd 0:0:0:0: [sda] Write Protect is off
      [   16.211439] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
      [   16.218771] sd 0:0:1:0: [sdb] 31457280 512-byte logical blocks: (16.1 GB/15.0 GiB)
      [   16.223264] sd 0:0:1:0: [sdb] Write Protect is off
      [   16.225682] sd 0:0:1:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
    
    This is also the reason why request_queues start in bypass mode which
    is ended on blk_register_queue() as shutting down a fully functional
    queue also involves a RCU grace period and the queues for non-existent
    SCSI devices never reach registration.
    
    blk-mq basically needs to do the same thing - start the mq in a
    degraded mode which is faster to shut down and then make it fully
    functional only after the queue reaches registration.  percpu_ref
    recently grew facilities to force atomic operation until explicitly
    switched to percpu mode, which can be used for this purpose.  This
    patch makes blk-mq initialize q->mq_usage_counter in atomic mode and
    switch it to percpu mode only once blk_register_queue() is reached.
    
    Note that this issue was previously worked around by 0a30288da1ae
    ("blk-mq, percpu_ref: implement a kludge for SCSI blk-mq stall during
    probe") for v3.17.  The temp fix was reverted in preparation of adding
    persistent atomic mode to percpu_ref by 9eca80461a45 ("Revert "blk-mq,
    percpu_ref: implement a kludge for SCSI blk-mq stall during probe"").
    This patch and the prerequisite percpu_ref changes will be merged
    during v3.18 devel cycle.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reported-by: Christoph Hellwig <[email protected]>
    Link: http://lkml.kernel.org/g/[email protected]
    Fixes: add703fda981 ("blk-mq: use percpu_ref for mq usage count")
    Reviewed-by: Kent Overstreet <[email protected]>
    Cc: Jens Axboe <[email protected]>
    Cc: Johannes Weiner <[email protected]>

commit e4de4d412fc0d07f820906dcd70ede06dad312e2
Author: Olof Johansson <[email protected]>
Date:   Wed Sep 24 10:34:06 2014 -0700

    ARM: at91: Fix bad conflict resolution in board-dt-sama5.c
    
    Signed-off-by: Olof Johansson <[email protected]>

commit 3c9703a87bdda1fef221ab0957a3ec2a2126f129
Author: Olof Johansson <[email protected]>
Date:   Wed Sep 24 10:32:20 2014 -0700

    Revert "ARM: make arrays containing machine compatible strings const"
    
    I dropped it from next/cleanup, doing a revert on for-next instead of
    rebuilding the branch.
    
    This reverts commit fbce9bc876ab2c905f1f82a78bc25745e98760d9.

commit 1cae13e75b7a7848c03138636d4eb8d8a5054dd5
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:50 2014 -0400

    percpu_ref: make INIT_ATOMIC and switch_to_atomic() sticky
    
    Currently, a percpu_ref which is initialized with
    PERPCU_REF_INIT_ATOMIC or switched to atomic mode via
    switch_to_atomic() automatically reverts to percpu mode on the first
    percpu_ref_reinit().  This makes the atomic mode difficult to use for
    cases where a percpu_ref is used as a persistent on/off switch which
    may be cycled multiple times.
    
    This patch makes such atomic state sticky so that it survives through
    kill/reinit cycles.  After this patch, atomic state is cleared only by
    an explicit percpu_ref_switch_to_percpu() call.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reviewed-by: Kent Overstreet <[email protected]>
    Cc: Jens Axboe <[email protected]>
    Cc: Christoph Hellwig <[email protected]>
    Cc: Johannes Weiner <[email protected]>

commit 2aad2a86f6685c10360ec8a5a55eb9ab7059cb72
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:50 2014 -0400

    percpu_ref: add PERCPU_REF_INIT_* flags
    
    With the recent addition of percpu_ref_reinit(), percpu_ref now can be
    used as a persistent switch which can be turned on and off repeatedly
    where turning off maps to killing the ref and waiting for it to drain;
    however, there currently isn't a way to initialize a percpu_ref in its
    off (killed and drained) state, which can be inconvenient for certain
    persistent switch use cases.
    
    Similarly, percpu_ref_switch_to_atomic/percpu() allow dynamic
    selection of operation mode; however, currently a newly initialized
    percpu_ref is always in percpu mode making it impossible to avoid the
    latency overhead of switching to atomic mode.
    
    This patch adds @flags to percpu_ref_init() and implements the
    following flags.
    
    * PERCPU_REF_INIT_ATOMIC	: start ref in atomic mode
    * PERCPU_REF_INIT_DEAD		: start ref killed and drained
    
    These flags should be able to serve the above two use cases.
    
    v2: target_core_tpg.c conversion was missing.  Fixed.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reviewed-by: Kent Overstreet <[email protected]>
    Cc: Jens Axboe <[email protected]>
    Cc: Christoph Hellwig <[email protected]>
    Cc: Johannes Weiner <[email protected]>

commit f47ad45784611297b699f3dffb6c7222b76afe64
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:49 2014 -0400

    percpu_ref: decouple switching to percpu mode and reinit
    
    percpu_ref has treated the dropping of the base reference and
    switching to atomic mode as an integral operation; however, there's
    nothing inherent tying the two together.
    
    The use cases for percpu_ref have been expanding continuously.  While
    the current init/kill/reinit/exit model can cover a lot, the coupling
    of kill/reinit with atomic/percpu mode switching is turning out to be
    too restrictive for use cases where many percpu_refs are created and
    destroyed back-to-back with only some of them reaching extended
    operation.  The coupling also makes implementing always-atomic debug
    mode difficult.
    
    This patch separates out percpu mode switching into
    percpu_ref_switch_to_percpu() and reimplements percpu_ref_reinit() on
    top of it.
    
    * DEAD still requires ATOMIC.  A dead ref can't be switched to percpu
      mode w/o going through reinit.
    
    v2: __percpu_ref_switch_to_percpu() was missing static.  Fixed.
        Reported by Fengguang aka kbuild test robot.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reviewed-by: Kent Overstreet <[email protected]>
    Cc: Jens Axboe <[email protected]>
    Cc: Christoph Hellwig <[email protected]>
    Cc: Johannes Weiner <[email protected]>
    Cc: kbuild test robot <[email protected]>

commit 490c79a65708873228cf114cf00e32c204e4e907
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:49 2014 -0400

    percpu_ref: decouple switching to atomic mode and killing
    
    percpu_ref has treated the dropping of the base reference and
    switching to atomic mode as an integral operation; however, there's
    nothing inherent tying the two together.
    
    The use cases for percpu_ref have been expanding continuously.  While
    the current init/kill/reinit/exit model can cover a lot, the coupling
    of kill/reinit with atomic/percpu mode switching is turning out to be
    too restrictive for use cases where many percpu_refs are created and
    destroyed back-to-back with only some of them reaching extended
    operation.  The coupling also makes implementing always-atomic debug
    mode difficult.
    
    This patch separates out atomic mode switching into
    percpu_ref_switch_to_atomic() and reimplements
    percpu_ref_kill_and_confirm() on top of it.
    
    * The handling of __PERCPU_REF_ATOMIC and __PERCPU_REF_DEAD is now
      differentiated.  Among get/put operations, percpu_ref_tryget_live()
      is the only one which cares about DEAD.
    
    * percpu_ref_switch_to_atomic() can be called multiple times on the
      same ref.  This means that multiple @confirm_switch may get queued
      up which we can't do reliably without extra memory area.  This is
      handled by making the later invocation synchronously wait for the
      completion of the previous one.  This isn't particularly desirable
      but such synchronous waits shouldn't happen in most cases.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reviewed-by: Kent Overstreet <[email protected]>
    Cc: Jens Axboe <[email protected]>
    Cc: Christoph Hellwig <[email protected]>
    Cc: Johannes Weiner <[email protected]>

commit 27344a9017cdaff82a167827da3001a0918afdc3
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:49 2014 -0400

    percpu_ref: add PCPU_REF_DEAD
    
    percpu_ref will be restructured so that percpu/atomic mode switching
    and reference killing are dedoupled.  In preparation, add
    PCPU_REF_DEAD and PCPU_REF_ATOMIC_DEAD which is OR of ATOMIC and DEAD.
    For now, ATOMIC and DEAD are changed together and all PCPU_REF_ATOMIC
    uses are converted to PCPU_REF_ATOMIC_DEAD without causing any
    behavior changes.
    
    percpu_ref_init() now specifies an explicit alignment when allocating
    the percpu counters so that the pointer has enough unused low bits to
    accomodate the flags.  Note that one flag was fine as min alignment
    for percpu memory is 2 bytes but two flags are already too many for
    the natural alignment of unsigned longs on archs like cris and m68k.
    
    v2: The original patch had BUILD_BUG_ON() which triggers if unsigned
        long's alignment isn't enough to accomodate the flags, which
        triggered on cris and m64k.  percpu_ref_init() updated to specify
        the required alignment explicitly.  Reported by Fengguang.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reviewed-by: Kent Overstreet <[email protected]>
    Cc: kbuild test robot <[email protected]>

commit 9e804d1f58da1eca079f796347c1cf1d1df564e2
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:48 2014 -0400

    percpu_ref: rename things to prepare for decoupling percpu/atomic mode switch
    
    percpu_ref will be restructured so that percpu/atomic mode switching
    and reference killing are dedoupled.  In preparation, do the following
    renames.
    
    * percpu_ref->confirm_kill	-> percpu_ref->confirm_switch
    * __PERCPU_REF_DEAD		-> __PERCPU_REF_ATOMIC
    * __percpu_ref_alive()		-> __ref_is_percpu()
    
    This patch is pure rename and doesn't introduce any functional
    changes.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reviewed-by: Kent Overstreet <[email protected]>

commit eecc16ba9a49b05dd847a317af166a6728eb56ca
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:48 2014 -0400

    percpu_ref: replace pcpu_ prefix with percpu_
    
    percpu_ref uses pcpu_ prefix for internal stuff and percpu_ for
    externally visible ones.  This is the same convention used in the
    percpu allocator implementation.  It works fine there but percpu_ref
    doesn't have too much internal-only stuff and scattered usages of
    pcpu_ prefix are confusing than helpful.
    
    This patch replaces all pcpu_ prefixes with percpu_.  This is pure
    rename and there's no functional change.  Note that PCPU_REF_DEAD is
    renamed to __PERCPU_REF_DEAD to signify that the flag is internal.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reviewed-by: Kent Overstreet <[email protected]>

commit 6251f9976af7656b6970a8820153f356430f5de2
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:48 2014 -0400

    percpu_ref: minor code and comment updates
    
    * Some comments became stale.  Updated.
    * percpu_ref_tryget() unnecessarily initializes @ret.  Removed.
    * A blank line removed from percpu_ref_kill_rcu().
    * Explicit function name in a WARN format string replaced with __func__.
    * WARN_ON() in percpu_ref_reinit() converted to WARN_ON_ONCE().
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reviewed-by: Kent Overstreet <[email protected]>

commit a2237370194484ee6aeeff04b617e4b14d178966
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:31:48 2014 -0400

    percpu_ref: relocate percpu_ref_reinit()
    
    percpu_ref is gonna go through restructuring.  Move
    percpu_ref_reinit() after percpu_ref_kill_and_confirm().  This will
    make later changes easier to follow and result in cleaner
    organization.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Reviewed-by: Kent Overstreet <[email protected]>

commit 1aafa57340c6d906a285d7823e0fe68696c1ae07
Author: Wei Xu <[email protected]>
Date:   Wed Sep 24 17:07:48 2014 +0800

    ARM: hisi: Fix platmcpm compilation when ARMv6 is selected
    
    When compiling with "ARCH=arm" and "allmodconfig",
    with commit: 9cdc99919a95e8b54c1998b65bb1bfdabd47d27b [2/7] ARM: hisi: enable MCPM implementation
    we will get:
    
       /tmp/cc6DjYjT.s: Assembler messages:
       /tmp/cc6DjYjT.s:63: Error: selected processor does not support ARM mode `ubfx r1,r0,#8,#8'
       /tmp/cc6DjYjT.s:761: Error: selected processor does not support ARM mode `isb '
       /tmp/cc6DjYjT.s:762: Error: selected processor does not support ARM mode `dsb '
       /tmp/cc6DjYjT.s:769: Error: selected processor does not support ARM mode `isb '
       /tmp/cc6DjYjT.s:775: Error: selected processor does not support ARM mode `isb '
       /tmp/cc6DjYjT.s:776: Error: selected processor does not support ARM mode `dsb '
       /tmp/cc6DjYjT.s:795: Error: selected processor does not support ARM mode `isb '
       /tmp/cc6DjYjT.s:801: Error: selected processor does not support ARM mode `isb '
       /tmp/cc6DjYjT.s:802: Error: selected processor does not support ARM mode `dsb '
    
    Fix platmcpm compilation when ARMv6 is selected.
    
    Signed-off-by: Wei Xu <[email protected]>
    Signed-off-by: Olof Johansson <[email protected]>

commit 495aa2e1facebf770224c33aae2a01541889e54e
Author: Liviu Dudau <[email protected]>
Date:   Tue Sep 23 20:01:14 2014 +0100

    arm64: Add architectural support for PCI
    
    Use the generic PCI domain and OF functions to provide support for PCI
    on arm64.
    
    [bhelgaas: Change comments to use generic PCI, not just PCIe.  Nothing at
    this level is PCIe-specific.]
    Signed-off-by: Liviu Dudau <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Acked-by: Catalin Marinas <[email protected]>

commit b766eafe68281a12169f9eb8c06fd80d2e7897d7
Author: Liviu Dudau <[email protected]>
Date:   Tue Sep 23 20:01:13 2014 +0100

    PCI: Add pci_remap_iospace() to map bus I/O resources
    
    Add pci_remap_iospace() to map bus I/O resources into the CPU virtual
    address space.  Architectures with special needs may provide their own
    version, but most should be able to use this one.
    
    This function is useful for PCI host bridge drivers that need to map the
    PCI I/O resources into virtual memory space.
    
    [bhelgaas: phys_addr description, drop temporary "err" variable]
    Signed-off-by: Liviu Dudau <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Reviewed-by: Rob Herring <[email protected]>
    Reviewed-by: Catalin Marinas <[email protected]>
    CC: Arnd Bergmann <[email protected]>

commit 5a4f662d44116022e3378b32a1a79b718e110096
Author: Liviu Dudau <[email protected]>
Date:   Tue Sep 23 20:01:12 2014 +0100

    PCI: Assign unassigned bus resources in pci_scan_root_bus()
    
    If the firmware has not assigned all the bus resources and we are not just
    probing the PCI buses, it makes sense to assign the unassigned resources
    in pci_scan_root_bus().
    
    Signed-off-by: Liviu Dudau <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    CC: Arnd Bergmann <[email protected]>
    CC: Jason Gunthorpe <[email protected]>
    CC: Rob Herring <[email protected]>

commit 07428b62addb624a3b51b6e8a213fec9b97dbfd0
Author: Liviu Dudau <[email protected]>
Date:   Wed Sep 24 11:27:33 2014 -0600

    of/pci: Add support for parsing PCI host bridge resources from DT
    
    Provide a function to parse the PCI DT ranges that can be used to create a
    pci_host_bridge structure together with its associated bus.
    
    Signed-off-by: Liviu Dudau <[email protected]>
    [make io_base parameter optional]
    Signed-off-by: Robert Richter <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    CC: Arnd Bergmann <[email protected]>
    CC: Grant Likely <[email protected]>
    CC: Rob Herring <[email protected]>
    CC: Catalin Marinas <[email protected]>

commit 9eca80461a45177e456219a9cd944c27675d6512
Author: Tejun Heo <[email protected]>
Date:   Wed Sep 24 13:07:33 2014 -0400

    Revert "blk-mq, percpu_ref: implement a kludge for SCSI blk-mq stall during probe"
    
    This reverts commit 0a30288da1aec914e158c2d7a3482a85f632750f, which
    was a temporary fix for SCSI blk-mq stall issue.  The following
    patches will fix the issue properly by introducing atomic mode to
    percpu_ref.
    
    Signed-off-by: Tejun Heo <[email protected]>
    Cc: Kent Overstreet <[email protected]>
    Cc: Jens Axboe <[email protected]>
    Cc: Christoph Hellwig <[email protected]>

commit 83417b202bf5aa2cd82637aa81aa9f065cfe5f21
Author: Wolfram Sang <[email protected]>
Date:   Mon Sep 22 19:41:00 2014 +0200

    i2c: move acpi code back into the core
    
    Commit 5d98e61d337c ("I2C/ACPI: Add i2c ACPI operation region support")
    renamed the i2c-core module. This may cause regressions for
    distributions, so put the ACPI code back into the core.
    
    Reported-by: Jean Delvare <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>
    Cc: Mika Westerberg <[email protected]>
    Cc: Lan Tianyu <[email protected]>

commit 964356938fcd3c0001a786f55b9f0a0fbe47656a
Author: Andreas Werner <[email protected]>
Date:   Wed Aug 27 19:53:06 2014 +0200

    hwmon: (menf21bmc) Introduce MEN14F021P00 BMC HWMON driver
    
    Added driver to support the 14F021P00 BMC Hardware Monitoring.
    The BMC is a Board Management Controller including monitoring of the
    board voltages.
    
    Signed-off-by: Andreas Werner <[email protected]>
    Reviewed-by: Guenter Roeck <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 38433639af915deeb0b0e28462dd740ce57b72fd
Author: Andreas Werner <[email protected]>
Date:   Wed Aug 27 19:52:36 2014 +0200

    leds: leds-menf21bmc: Introduce MEN 14F021P00 BMC LED driver
    
    Added driver to support the 14F021P00 BMC LEDs.
    The BMC is a Board Management Controller including four LEDs which
    can be switched on and off.
    
    Signed-off-by: Andreas Werner <[email protected]>
    Acked-by: Bryan Wu <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 5033263992eece84e19946d2cab940c86ec862ba
Author: Andreas Werner <[email protected]>
Date:   Wed Aug 27 19:52:06 2014 +0200

    watchdog: menf21bmc_wdt: Introduce MEN 14F021P00 BMC Watchdog driver
    
    Added driver to support the 14F021P00 BMC Watchdog.
    The BMC is a Board Management Controller including watchdog functionality.
    
    Signed-off-by: Andreas Werner <[email protected]>
    Reviewed-by: Guenter Roeck <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit d6cc1f5824cbca392d099f3bb0c441efd9e54de9
Author: Krzysztof Kozlowski <[email protected]>
Date:   Fri Sep 12 08:54:00 2014 +0200

    Documentation: charger: max14577: Document exported sysfs entry
    
    Document the 'fast charge timer' setting exported by max14577 driver
    through sysfs entry.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Acked-by: Andrew Morton <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 8d70d68d7a1b3082ca5a3808be18103a83ae348d
Author: Krzysztof Kozlowski <[email protected]>
Date:   Fri Sep 12 08:53:59 2014 +0200

    devicetree: mfd: max14577: Add device tree bindings document
    
    Add document describing device tree bindings for MAX14577 MFD
    drivers: MFD core, extcon, regulator and charger.
    
    Both MAX14577 and MAX77836 chipsets are documented.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Reviewed-by: Tomasz Figa <[email protected]>
    Acked-by: Andrew Morton <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 2c33e9296202cd11bf2e2f801b69ffba0953748a
Author: Krzysztof Kozlowski <[email protected]>
Date:   Fri Sep 12 08:53:58 2014 +0200

    power: max17040: Add ID for MAX77836 Fuel Gauge block
    
    MAX77836 has the same Fuel Gauge as MAX17040/17048. The max17040 driver
    can be safely re-used. The patch adds MAX77836 device to the array of
    i2c_device_id. Additionally it removes the id associated with MAX17040
    device as the value is not used.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Acked-by: Andrew Morton <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit e30110e9c96f48aea01abc3e6dfadb369cbafec3
Author: Krzysztof Kozlowski <[email protected]>
Date:   Fri Sep 12 08:53:57 2014 +0200

    charger: max14577: Configure battery-dependent settings from DTS and sysfs
    
    Remove hard-coded values for:
     - Fast Charge current,
     - End Of Charge current,
     - Fast Charge timer,
     - Overvoltage Protection Threshold,
     - Battery Constant Voltage,
    and use DTS or sysfs to configure them. This allows using the max14577 charger
    driver with different batteries.
    
    Now the charger driver requires valid configuration data from DTS. In
    case of wrong configuration data it fails during probe.
    
    The fast charge timer is configured through sysfs entry.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Acked-by: Andrew Morton <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit b8f139f68f2099b7f8b4ef470a1e53210e3aa025
Author: Krzysztof Kozlowski <[email protected]>
Date:   Fri Sep 12 08:53:56 2014 +0200

    regulator/mfd: max14577: Export symbols for calculating charger current
    
    This patch prepares for changing the max14577 charger driver to allow
    configuring battery-dependent settings from DTS.
    
    The patch moves from regulator driver to MFD core driver and exports:
     - function for calculating register value for charger's current;
     - table of limits for chargers (MAX14577, MAX77836).
    
    Previously they were used only by the max14577 regulator driver. In next
    patch the charger driver will use them as well. Exporting them will
    reduce unnecessary code duplication.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Acked-by: Mark Brown <[email protected]>
    Acked-by: Andrew Morton <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 3682a8ee87f9107253e51733f42da10160ce41e3
Author: Krzysztof Kozlowski <[email protected]>
Date:   Fri Sep 12 08:53:55 2014 +0200

    charger: max14577: Add support for MAX77836 charger
    
    Add support for MAX77836 charger to the max14577 driver. The MAX77836
    charger is almost the same as 14577 model except:
     - No dead-battery detection;
     - Support for special charger (like in MAX77693);
     - Support for DX over-voltage protection (like in MAX77693);
     - Lower values of charging current (two times lower current for
       slow/fast charge, much lower EOC current);
     - Slightly different values in ChgTyp field of STATUS2 register. On
       MAX14577 0x6 is reserved and 0x7 dead battery. On the MAX77836 the
       0x6 means special charger and 0x7 is reserved. Regardless of these
       differences the driver maps them to one enum max14577_muic_charger_type.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Acked-by: Andrew Morton <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 2f4096e311ef0922c42cbf7bc5df44efb3aff716
Author: Quentin Lambert <[email protected]>
Date:   Sun Sep 7 20:04:28 2014 +0200

    PCI: Remove assignment from complicated "if" conditions
    
    The modifications effectively change the value of len_tmp
    in the case where the first condition is not met.
    
    Signed-off-by: Quentin Lambert <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 79e50e72986c9fcb06d707ce587cfd24fefa33e3
Author: Quentin Lambert <[email protected]>
Date:   Sun Sep 7 20:03:32 2014 +0200

    PCI: Remove assignment from "if" conditions
    
    The following Coccinelle semantic patch was used to find and correct cases
    of assignments in "if" conditions:
    
    @@
    expression var, expr;
    statement S;
    @@
    
    + var = expr;
      if(
    - (var = expr)
    + var
      ) S
    
    Signed-off-by: Quentin Lambert <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 656f978f9af9d8d77436e8159f51f7aa1e673309
Author: Quentin Lambert <[email protected]>
Date:   Sun Sep 7 20:02:47 2014 +0200

    PCI: Remove unnecessary curly braces
    
    Remove curly braces in simple "if" cases.
    
    No functional change.
    
    Signed-off-by: Quentin Lambert <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit e0c524049f8279d00d2fbd4748b03234a2726fdd
Author: Santosh Shilimkar <[email protected]>
Date:   Thu Jul 10 11:30:08 2014 -0400

    MAINTAINERS: Add Keystone Multicore Navigator drivers entry
    
    Signed-off-by: Santosh Shilimkar <[email protected]>

commit 88139ed030583557751e279968e13e892ae10825
Author: Santosh Shilimkar <[email protected]>
Date:   Sun Mar 30 17:29:04 2014 -0400

    soc: ti: add Keystone Navigator DMA support
    
    The Keystone Navigator DMA driver sets up the dma channels and flows for
    the QMSS(Queue Manager SubSystem) who triggers the actual data movements
    across clients using destination queues. Every client modules like
    NETCP(Network Coprocessor), SRIO(Serial Rapid IO) and CRYPTO
    Engines has its own instance of packet dma hardware. QMSS has also
    an internal packet DMA module which is used as an infrastructure
    DMA with zero copy.
    
    Initially this driver was proposed as DMA engine driver but since the
    hardware is not typical DMA engine and hence doesn't comply with typical
    DMA engine driver needs, that approach was naked. Link to that
    discussion -
    	https://lkml.org/lkml/2014/3/18/340
    
    As aligned, now we pair the Navigator DMA with its companion Navigator
    QMSS subsystem driver.
    
    Cc: Greg Kroah-Hartman <[email protected]>
    Cc: Kumar Gala <[email protected]>
    Cc: Olof Johansson <[email protected]>
    Cc: Arnd Bergmann <[email protected]>
    Cc: Grant Likely <[email protected]>
    Cc: Rob Herring <[email protected]>
    Cc: Mark Rutland <[email protected]>
    Signed-off-by: Sandeep Nair <[email protected]>
    Signed-off-by: Santosh Shilimkar <[email protected]>

commit 8172296d8717be1951da4bb4feb2700a60e8cdde
Author: Santosh Shilimkar <[email protected]>
Date:   Sun Mar 30 17:29:04 2014 -0400

    Documentation: dt: soc: add Keystone Navigator DMA bindings
    
    The Keystone Navigator DMA driver sets up the dma channels and flows for
    the QMSS(Queue Manager SubSystem) who triggers the actual data movements
    across clients using destination queues. Every client modules like
    NETCP(Network Coprocessor), SRIO(Serial Rapid IO) and CRYPTO
    Engines has its own instance of packet dma hardware. QMSS has also
    an internal packet DMA module which is used as an infrastructure
    DMA with zero copy.
    
    Initially this driver was proposed as DMA engine driver but since the
    hardware is not typical DMA engine and hence doesn't comply with typical
    DMA engine driver needs, that approach was naked. Link to that
    discussion -
    	https://lkml.org/lkml/2014/3/18/340
    
    As aligned, now we pair the Navigator DMA with its companion Navigator
    QMSS subsystem driver.
    
    Cc: Greg Kroah-Hartman <[email protected]>
    Cc: Kumar Gala <[email protected]>
    Cc: Olof Johansson <[email protected]>
    Cc: Arnd Bergmann <[email protected]>
    Cc: Grant Likely <[email protected]>
    Cc: Rob Herring <[email protected]>
    Cc: Mark Rutland <[email protected]>
    Signed-off-by: Sandeep Nair <[email protected]>
    Signed-off-by: Santosh Shilimkar <[email protected]>

commit 41f93af900a20d1a0a358b522b5129c89677e9dc
Author: Sandeep Nair <[email protected]>
Date:   Fri Feb 28 10:47:50 2014 -0500

    soc: ti: add Keystone Navigator QMSS driver
    
    The QMSS (Queue Manager Sub System) found on Keystone SOCs is one of
    the main hardware sub system which forms the backbone of the Keystone
    Multi-core Navigator. QMSS consist of queue managers, packed-data structure
    processors(PDSP), linking RAM, descriptor pools and infrastructure
    Packet DMA.
    
    The Queue Manager is a hardware module that is responsible for accelerating
    management of the packet queues. Packets are queued/de-queued by writing or
    reading descriptor address to a particular memory mapped location. The PDSPs
    perform QMSS related functions like accumulation, QoS, or event management.
    Linking RAM registers are used to link the descriptors which are stored in
    descriptor RAM. Descriptor RAM is configurable as internal or external memory.
    
    The QMSS driver manages the PDSP setups, linking RAM regions,
    queue pool management (allocation, push, pop and notify) and descriptor
    pool management. The specifics on the device tree bindings for
    QMSS can be found in:
    	Documentation/devicetree/bindings/soc/keystone-navigator-qmss.txt
    
    Cc: Greg Kroah-Hartman <[email protected]>
    Cc: Kumar Gala <[email protected]>
    Cc: Olof Johansson <[email protected]>
    Cc: Arnd Bergmann <[email protected]>
    Cc: Grant Likely <[email protected]>
    Cc: Rob Herring <[email protected]>
    Cc: Mark Rutland <[email protected]>
    Signed-off-by: Sandeep Nair <[email protected]>
    Signed-off-by: Santosh Shilimkar <[email protected]>

commit a4dfb8c41043dd6c2b9defbe846c44389c4b6f02
Author: Sandeep Nair <[email protected]>
Date:   Fri Feb 28 10:47:50 2014 -0500

    Documentation: dt: soc: add Keystone Navigator QMSS bindings
    
    The QMSS (Queue Manager Sub System) found on Keystone SOCs is one of
    the main hardware sub system which forms the backbone of the Keystone
    Multi-core Navigator. QMSS consist of queue managers, packed-data structure
    processors(PDSP), linking RAM, descriptor pools and infrastructure
    Packet DMA.
    
    The Queue Manager is a hardware module that is responsible for accelerating
    management of the packet queues. Packets are queued/de-queued by writing or
    reading descriptor address to a particular memory mapped location. The PDSPs
    perform QMSS related functions like accumulation, QoS, or event management.
    Linking RAM registers are used to link the descriptors which are stored in
    descriptor RAM. Descriptor RAM is configurable as internal or external memory.
    
    Cc: Greg Kroah-Hartman <[email protected]>
    Cc: Kumar Gala <[email protected]>
    Cc: Olof Johansson <[email protected]>
    Cc: Arnd Bergmann <[email protected]>
    Cc: Grant Likely <[email protected]>
    Cc: Rob Herring <[email protected]>
    Cc: Mark Rutland <[email protected]>
    Signed-off-by: Sandeep Nair <[email protected]>
    Signed-off-by: Santosh Shilimkar <[email protected]>

commit 382a9c9adc1cd540f5b714b65db315fc1c0b553d
Author: Quentin Lambert <[email protected]>
Date:   Sun Sep 7 20:02:04 2014 +0200

    PCI: Add space before open parenthesis
    
    Add space before open parenthesis as is conventional.
    
    No functional change.
    
    [bhelgaas: fix a few more in ibmphp, shpchp]
    Signed-off-by: Quentin Lambert <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit fe6ce32189136370b3d236d1c32ab812b93cd0d8
Author: Yijing Wang <[email protected]>
Date:   Wed Sep 24 11:09:59 2014 +0800

    PCI/MSI: Rename __read_msi_msg() to read_msi_msg()
    
    Rename __read_msi_msg() to read_msi_msg().
    
    No functional change.
    
    Signed-off-by: Yijing Wang <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit c2eb2dc3461e522d6452e1f74e36194633d4db0d
Author: Yijing Wang <[email protected]>
Date:   Wed Sep 24 11:09:53 2014 +0800

    PCI/MSI: Remove unused read_msi_msg()
    
    Now no one uses read_msi_msg(), so remove it.
    
    No functional change.
    
    Signed-off-by: Yijing Wang <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 11c013fd8afbc7c6b2e15608ed5fc2c249552998
Author: Yijing Wang <[email protected]>
Date:   Wed Sep 24 11:09:45 2014 +0800

    MSI/powerpc: Use __read_msi_msg() instead of read_msi_msg()
    
    rtas_setup_msi_irqs() already has the struct msi_desc pointer required by
    __read_msi_msg(), so call it directly instead of having read_msi_msg() look
    it up from the IRQ.
    
    No functional change.
    
    [bhelgaas: changelog]
    Signed-off-by: Yijing Wang <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Acked-by: Michael Ellerman <[email protected]>
    CC: Benjamin Herrenschmidt <[email protected]>
    CC: [email protected]

commit eeeda4cd06e828b331b15741a204ff9f5874d28d
Author: Ben Hutchings <[email protected]>
Date:   Wed Sep 24 13:30:12 2014 +0100

    x86/relocs: Make per_cpu_load_addr static
    
    per_cpu_load_addr is only used for 64-bit relocations, but is
    declared in both configurations of relocs.c - with different
    types.  This has undefined behaviour in general.  GNU ld is
    documented to use the larger size in this case, but other tools
    may differ and some warn about this.
    
    References: https://bugs.debian.org/748577
    Reported-by: Michael Tautschnig <[email protected]>
    Signed-off-by: Ben Hutchings <[email protected]>
    Cc: [email protected]
    Cc: Linus Torvalds <[email protected]>
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ingo Molnar <[email protected]>

commit 212be3b2320bcf33eff648bc4e1f0edbf4d90acf
Author: Oleg Nesterov <[email protected]>
Date:   Sun Sep 21 20:42:32 2014 +0200

    x86/lib/Makefile: Remove the unnecessary "+= thunk_64.o"
    
    Trivial. We have "lib-y += thunk_$(BITS).o" at the start, no
    need to add thunk_64.o if !CONFIG_X86_32.
    
    Signed-off-by: Oleg Nesterov <[email protected]>
    Acked-by: Andy Lutomirski <[email protected]>
    Cc: Denys Vlasenko <[email protected]>
    Cc: Peter Zijlstra <[email protected]>
    Cc: Linus Torvalds <[email protected]>
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ingo Molnar <[email protected]>

commit 0ad6e3c5199be12c9745da8f8b9e3c9f8066c235
Author: Oleg Nesterov <[email protected]>
Date:   Sun Sep 21 20:41:53 2014 +0200

    x86: Speed up ___preempt_schedule*() by using THUNK helpers
    
    ___preempt_schedule() does SAVE_ALL/RESTORE_ALL but this is
    suboptimal, we do not need to save/restore the callee-saved
    register. And we already have arch/x86/lib/thunk_*.S which
    implements the similar asm wrappers, so it makes sense to
    redefine ___preempt_schedule() as "THUNK ..." and remove
    preempt.S altogether.
    
    Signed-off-by: Oleg Nesterov <[email protected]>
    Reviewed-by: Andy Lutomirski <[email protected]>
    Cc: Denys Vlasenko <[email protected]>
    Cc: Peter Zijlstra <[email protected]>
    Cc: Linus Torvalds <[email protected]>
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ingo Molnar <[email protected]>

commit 03bd4e1f7265548832a76e7919a81f3137c44fd1
Author: Wanpeng Li <[email protected]>
Date:   Wed Sep 24 16:38:05 2014 +0800

    sched: Fix unreleased llc_shared_mask bit during CPU hotplug
    
    The following bug can be triggered by hot adding and removing a large number of
    xen domain0's vcpus repeatedly:
    
    	BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: [..] find_busiest_group
    	PGD 5a9d5067 PUD 13067 PMD 0
    	Oops: 0000 [#3] SMP
    	[...]
    	Call Trace:
    	load_balance
    	? _raw_spin_unlock_irqrestore
    	idle_balance
    	__schedule
    	schedule
    	schedule_timeout
    	? lock_timer_base
    	schedule_timeout_uninterruptible
    	msleep
    	lock_device_hotplug_sysfs
    	online_store
    	dev_attr_store
    	sysfs_write_file
    	vfs_write
    	SyS_write
    	system_call_fastpath
    
    Last level cache shared mask is built during CPU up and the
    build_sched_domain() routine takes advantage of it to setup
    the sched domain CPU topology.
    
    However, llc_shared_mask is not released during CPU disable,
    which leads to an invalid sched domainCPU topology.
    
    This patch fix it by releasing the llc_shared_mask correctly
    during CPU disable.
    
    Yasuaki also reported that this can happen on real hardware:
    
      https://lkml.org/lkml/2014/7/22/1018
    
    His case is here:
    
    	==
    	Here is an example on my system.
    	My system has 4 sockets and each socket has 15 cores and HT is
    	enabled. In this case, each core of sockes is numbered as
    	follows:
    
    		 | CPU#
    	Socket#0 | 0-14 , 60-74
    	Socket#1 | 15-29, 75-89
    	Socket#2 | 30-44, 90-104
    	Socket#3 | 45-59, 105-119
    
    	Then llc_shared_mask of CPU#30 has 0x3fff80000001fffc0000000.
    
    	It means that last level cache of Socket#2 is shared with
    	CPU#30-44 and 90-104.
    
    	When hot-removing socket#2 and #3, each core of sockets is
    	numbered as follows:
    
    		 | CPU#
    	Socket#0 | 0-14 , 60-74
    	Socket#1 | 15-29, 75-89
    
    	But llc_shared_mask is not cleared. So llc_shared_mask of CPU#30
    	remains having 0x3fff80000001fffc0000000.
    
    	After that, when hot-adding socket#2 and #3, each core of
    	sockets is numbered as follows:
    
    		 | CPU#
    	Socket#0 | 0-14 , 60-74
    	Socket#1 | 15-29, 75-89
    	Socket#2 | 30-59
    	Socket#3 | 90-119
    
    	Then llc_shared_mask of CPU#30 becomes
    	0x3fff8000fffffffc0000000. It means that last level cache of
    	Socket#2 is shared with CPU#30-59 and 90-104. So the mask has
    	the wrong value.
    
    Signed-off-by: Wanpeng Li <[email protected]>
    Tested-by: Linn Crosetto <[email protected]>
    Reviewed-by: Borislav Petkov <[email protected]>
    Reviewed-by: Toshi Kani <[email protected]>
    Reviewed-by: Yasuaki Ishimatsu <[email protected]>
    Cc: <[email protected]>
    Cc: David Rientjes <[email protected]>
    Cc: Prarit Bhargava <[email protected]>
    Cc: Steven Rostedt <[email protected]>
    Cc: Peter Zijlstra <[email protected]>
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ingo Molnar <[email protected]>

commit 24832b4de315ad00e5430a53772750dfcf18514d
Author: Minghuan Lian <[email protected]>
Date:   Tue Sep 23 22:28:59 2014 +0800

    PCI: designware: Add get_msi_data() to pcie_host_ops
    
    Add a struct pcie_host_ops .get_msi_data() method for platforms to return
    their special MSI message data.
    
    Signed-off-by: Minghuan Lian <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Acked-by: Mohit KUMAR <[email protected]>

commit ee1b5b165c0a2f04d2107e634e51f05d0eb107de
Author: Bryan O'Donoghue <[email protected]>
Date:   Wed Sep 24 00:26:24 2014 +0100

    x86/intel/quark: Switch off CR4.PGE so TLB flush uses CR3 instead
    
    Quark x1000 advertises PGE via the standard CPUID method
    PGE bits exist in Quark X1000's PTEs. In order to flush
    an individual PTE it is necessary to reload CR3 irrespective
    of the PTE.PGE bit.
    
    See Quark Core_DevMan_001.pdf section 6.4.11
    
    This bug was fixed in Galileo kernels, unfixed vanilla kernels are expected to
    crash and burn on this platform.
    
    Signed-off-by: Bryan O'Donoghue <[email protected]>
    Cc: Borislav Petkov <[email protected]>
    Cc: <[email protected]>
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Ingo Molnar <[email protected]>

commit 450e344e421b9f555261a2d97952d9e71d4cb082
Author: Minghuan Lian <[email protected]>
Date:   Tue Sep 23 22:28:58 2014 +0800

    PCI: designware: Rename get_msi_data() to get_msi_addr()
    
    The struct pcie_host_ops .get_msi_data() method returns the MSI message
    address.  To accurately express its purpose, rename it to .get_msi_addr().
    
    Signed-off-by: Minghuan Lian <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Acked-by: Mohit KUMAR <[email protected]>

commit 0c61ea77cceafd1134225099961c2df0866b500f
Author: Minghuan Lian <Minghuan.Lian@fre…
aryabinin referenced this pull request in aryabinin/linux Oct 3, 2014
@hnaz
linux-next
5d86c8a 
GIT 6fe676b243e5a0cb4cc4d9a4b094de8db0cdbf74

commit e500f488c27659bb6f5d313b336621f3daa67701
Author: Fabian Frederick <[email protected]>
Date:   Wed Oct 1 06:52:06 2014 +0200

    net/dccp/ccid.c: add __init to ccid_activate
    
    ccid_activate is only called by __init ccid_initialize_builtins in same module.
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 0c5b8a46294d43fc63788839d3c18de0961ec1bc
Author: Fabian Frederick <[email protected]>
Date:   Wed Oct 1 06:48:03 2014 +0200

    net/dccp/proto.c: add __init to dccp_mib_init
    
    dccp_mib_init is only called by __init dccp_init in same module.
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 082f58ac4a48d3f5cb4597232cb2ac6823a96f43
Author: Quinn Tran <[email protected]>
Date:   Thu Sep 25 06:22:28 2014 -0400

    target: Fix queue full status NULL pointer for SCF_TRANSPORT_TASK_SENSE
    
    During temporary resource starvation at lower transport layer, command
    is placed on queue full retry path, which expose this problem.  The TCM
    queue full handling of SCF_TRANSPORT_TASK_SENSE currently sends the same
    cmd twice to lower layer.  The 1st time led to cmd normal free path.
    The 2nd time cause Null pointer access.
    
    This regression bug was originally introduced v3.1-rc code in the
    following commit:
    
    commit e057f53308a5f071556ee80586b99ee755bf07f5
    Author: Christoph Hellwig <[email protected]>
    Date:   Mon Oct 17 13:56:41 2011 -0400
    
        target: remove the transport_qf_callback se_cmd callback
    
    Signed-off-by: Quinn Tran <[email protected]>
    Signed-off-by: Saurav Kashyap <[email protected]>
    Cc: <[email protected]> # v3.1+
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit db3a99b9921f27fe71ca8c0f218ee810e0e7fb69
Author: Joern Engel <[email protected]>
Date:   Tue Sep 16 16:23:19 2014 -0400

    qla_target: rearrange struct qla_tgt_prm
    
    On most (non-x86) 64bit platforms this will remove 8 padding bytes
    from the structure.
    
    Signed-off-by: Joern Engel <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit f9b6721a9cef94908467abf7a2cacbd15a7d23cb
Author: Joern Engel <[email protected]>
Date:   Tue Sep 16 16:23:18 2014 -0400

    qla_target: improve qlt_unmap_sg()
    
    Remove the inline attribute.  Modern compilers ignore it and the
    function has grown beyond where inline made sense anyway.
    Remove the BUG_ON(!cmd->sg_mapped), and instead return if sg_mapped is
    not set.  Every caller is doing this check, so we might as well have it
    in one place instead of four.
    
    Signed-off-by: Joern Engel <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit 55a9066fffd2f533e7ed434b072469ef09d6c476
Author: Joern Engel <[email protected]>
Date:   Tue Sep 16 16:23:15 2014 -0400

    qla_target: make some global functions static
    
    Also removes the declarations from the header - including two
    declarations without function definitions or callers.
    
    Signed-off-by: Joern Engel <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit c57010420654aca179c500f61e86315a337244ca
Author: Joern Engel <[email protected]>
Date:   Tue Sep 16 16:23:14 2014 -0400

    qla_target: remove unused parameter
    
    Signed-off-by: Joern Engel <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit f81ccb489a7a641c1bed41b49cf8d72c199c68d5
Author: Joern Engel <[email protected]>
Date:   Tue Sep 16 16:23:13 2014 -0400

    target: simplify core_tmr_abort_task
    
    list_for_each_entry_safe is necessary if list objects are deleted from
    the list while traversing it.  Not the case here, so we can use the base
    list_for_each_entry variant.
    
    Signed-off-by: Joern Engel <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit 33940d09937276cd3c81f2874faf43e37c2db0e2
Author: Joern Engel <[email protected]>
Date:   Tue Sep 16 16:23:12 2014 -0400

    target: encapsulate smp_mb__after_atomic()
    
    The target code has a rather generous helping of smp_mb__after_atomic()
    throughout the code base.  Most atomic operations were followed by one
    and none were preceded by smp_mb__before_atomic(), nor accompanied by a
    comment explaining the need for a barrier.
    
    Instead of trying to prove for every case whether or not it is needed,
    this patch introduces atomic_inc_mb() and atomic_dec_mb(), which
    explicitly include the memory barriers before and after the atomic
    operation.  For now they are defined in a target header, although they
    could be of general use.
    
    Most of the existing atomic/mb combinations were replaced by the new
    helpers.  In a few cases the atomic was sandwiched in
    spin_lock/spin_unlock and I simply removed the barrier.
    
    I suspect that in most cases the correct conversion would have been to
    drop the barrier.  I also suspect that a few cases exist where a) the
    barrier was necessary and b) a second barrier before the atomic would
    have been necessary and got added by this patch.
    
    Signed-off-by: Joern Engel <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit 74ed7e62289dc6d388996d7c8f89c2e7e95b9657
Author: Joern Engel <[email protected]>
Date:   Tue Sep 16 16:23:11 2014 -0400

    target: remove some smp_mb__after_atomic()s
    
    atomic_inc_return() already does an implicit memory barrier and the
    second case was moved from an atomic to a plain flag operation.  If a
    barrier were needed in the second case, it would have to be smp_mb(),
    not a variant optimized away for x86 and other architectures.
    
    Signed-off-by: Joern Engel <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit 8f83269048628d7b139dacbfc6cc97befcbdd2e9
Author: Joern Engel <[email protected]>
Date:   Tue Sep 16 16:23:10 2014 -0400

    target: simplify core_tmr_release_req()
    
    And while at it, do minimal coding style fixes in the area.
    
    Signed-off-by: Joern Engel <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit 9c7d6154bc4b9dfefd580490cdca5f7c72321464
Author: Andy Grover <[email protected]>
Date:   Mon Jun 30 16:39:46 2014 -0700

    target: Remove core_tpg_release_virtual_lun0 function
    
    Simple and just called from one place.
    
    Reviewed-by: Christoph Hellwig <[email protected]>
    Signed-off-by: Andy Grover <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit cd9d7cbaec8b622eee4edcd8bf481c4047f74915
Author: Andy Grover <[email protected]>
Date:   Mon Jun 30 16:39:44 2014 -0700

    target: Change core_dev_del_lun to take a se_lun instead of unpacked_lun
    
    Remove core_tpg_pre_dellun entirely, since we don't need to get/check
    a pointer we already have.
    
    Nothing else can return an error, so core_dev_del_lun can return void.
    
    Rename core_tpg_post_dellun to remove_lun - a clearer name, now that
    pre_dellun is gone.
    
    Reviewed-by: Christoph Hellwig <[email protected]>
    Signed-off-by: Andy Grover <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit cc83881f2c57caaf4b14adaffa65595640a59661
Author: Andy Grover <[email protected]>
Date:   Mon Jun 30 16:39:43 2014 -0700

    target: core_tpg_post_dellun can return void
    
    Nothing in it can raise an error.
    
    Reviewed-by: Christoph Hellwig <[email protected]>
    Signed-off-by: Andy Grover <[email protected]>
    Signed-off-by: Nicholas Bellinger <[email protected]>

commit 49be17235c0acd96f2ff0fe282867fe3a83f554c
Author: hayeswang <[email protected]>
Date:   Wed Oct 1 13:25:11 2014 +0800

    r8152: disable power cut for RTL8153
    
    The firmware would be clear when the power cut is enabled for
    RTL8153.
    
    Signed-off-by: Hayes Wang <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 204c8704128943bf3f8b605f4b40bdc2b6bd89dc
Author: hayeswang <[email protected]>
Date:   Wed Oct 1 13:25:10 2014 +0800

    r8152: remove clearing bp
    
    The xxx_clear_bp() is used to halt the firmware. It only necessary
    for updating the new firmware. Besides, depend on the version of
    the current firmware, it may have problem to halt the firmware
    directly. Finally, halt the firmware would let the firmware code
    useless, and the bugs which are fixed by the firmware would occur.
    
    Signed-off-by: Hayes Wang <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit aa55c8e2f7a395dfc9e67fc6637321e19ce9bfe1
Author: Masahiro Yamada <[email protected]>
Date:   Tue Sep 9 20:02:24 2014 +0900

    kbuild: handle C=... and M=... after entering into build directory
    
    This commit avoids processing C=... and M=... twice
    when O=... is also given.
    
    Besides, we can also remove KBUILD_EXTMOD="$(KBUILD_EXTMOD)"
    in the sub-make target.
    
    Signed-off-by: Masahiro Yamada <[email protected]>
    Acked-by: Peter Foley <[email protected]>
    Signed-off-by: Michal Marek <[email protected]>

commit 745a254322c898dadf019342cd7140f7867d2d0f
Author: Masahiro Yamada <[email protected]>
Date:   Tue Sep 9 20:02:23 2014 +0900

    kbuild: use $(Q) for sub-make target
    
    Since commit 066b7ed9558087a7957a1128f27d7a3462ff117f
    (kbuild: Do not print the build directory with make -s),
    "Q" is defined above the sub-make target.
    
    This commit takes advantage of that and replaces
    "$(if $(KBUILD_VERBOSE:1=),@)" with "$(Q)".
    
    Signed-off-by: Masahiro Yamada <[email protected]>
    Acked-by: Peter Foley <[email protected]>
    Signed-off-by: Michal Marek <[email protected]>

commit 7ff525712acf9325e9acdb27bbc93049ea2e850c
Author: Masahiro Yamada <[email protected]>
Date:   Tue Sep 9 20:02:22 2014 +0900

    kbuild: fake the "Entering directory ..." message more simply
    
    Commit c2e28dc975ea87feed84415006ae143424912ac7
    (kbuild: Print the name of the build directory)
    added a gimmick to show the "Entering directory ...".
    
    Instead of echoing the hard-coded message (that is, we need to know
    the exact message), moving --no-print-directory would be easier.
    
    Signed-off-by: Masahiro Yamada <[email protected]>
    Acked-by: Peter Foley <[email protected]>
    Signed-off-by: Michal Marek <[email protected]>

commit 1b0ecb28b0cc216535ce6477d39aa610c3ff68a1
Author: Vlad Yasevich <[email protected]>
Date:   Tue Sep 30 19:39:37 2014 -0400

    bnx2: Correctly receive full sized 802.1ad fragmes
    
    This driver, similar to tg3, has a check that will
    cause full sized 802.1ad frames to be dropped.  The
    frame will be larger then the standard mtu due to the
    presense of vlan header that has not been stripped.
    The driver should not drop this frame and should process
    it just like it does for 802.1q.
    
    CC: Sony Chacko <[email protected]>
    CC: [email protected]
    Signed-off-by: Vladislav Yasevich <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 7d3083ee36b51e425b6abd76778a2046906b0fd3
Author: Vlad Yasevich <[email protected]>
Date:   Tue Sep 30 19:39:36 2014 -0400

    tg3: Allow for recieve of full-size 8021AD frames
    
    When receiving a vlan-tagged frame that still contains
    a vlan header, the length of the packet will be greater
    then MTU+ETH_HLEN since it will account of the extra
    vlan header.  TG3 checks this for the case for 802.1Q,
    but not for 802.1ad.  As a result, full sized 802.1ad
    frames get dropped by the card.
    
    Add a check for 802.1ad protocol when receving full
    sized frames.
    
    Suggested-by: Prashant Sreedharan <[email protected]>
    CC: Prashant Sreedharan <[email protected]>
    CC: Michael Chan <[email protected]>
    Signed-off-by: Vladislav Yasevich <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 1e918876853aa85435e0f17fd8b4a92dcfff53d6
Author: Florian Westphal <[email protected]>
Date:   Wed Oct 1 13:38:03 2014 +0200

    r8169: add support for Byte Queue Limits
    
    tested on RTL8168d/8111d model using 'super_netperf 40' with TCP/UDP_STREAM.
    
    Output of
    while true; do
        for n in inflight limit; do
              echo -n $n\ ; cat $n;
        done;
        sleep 1;
    done
    
    during netperf run, 100mbit peer:
    
    inflight 0
    limit 3028
    inflight 6056
    limit 4542
    
    [ trimmed output for brevity, no limit/inflight changes during
      test steady-state ]
    
    limit 4542
    inflight 3028
    limit 6122
    inflight 0
    limit 6122
    [ changed cable to 1gbit peer, restart netperf ]
    inflight 37850
    limit 36336
    inflight 33308
    limit 31794
    inflight 33308
    limit 31794
    inflight 27252
    limit 25738
    [ again, no changes during test ]
    inflight 27252
    limit 25738
    inflight 0
    limit 28766
    [ change cable to 100mbit peer, restart netperf ]
    limit 28766
    inflight 27370
    limit 28766
    inflight 4542
    limit 5990
    inflight 6056
    limit 4542
    [ .. ]
    inflight 6056
    limit 4542
    inflight 0
    
    [end of test]
    
    Cc: Francois Romieu <[email protected]>
    Cc: Hayes Wang <[email protected]>
    Signed-off-by: Florian Westphal <[email protected]>
    Acked-by: Eric Dumazet <[email protected]>
    Acked-by: Tom Herbert <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit d0bf4a9e92b9a93ffeeacbd7b6cb83e0ee3dc2ef
Author: Eric Dumazet <[email protected]>
Date:   Mon Sep 29 13:29:15 2014 -0700

    net: cleanup and document skb fclone layout
    
    Lets use a proper structure to clearly document and implement
    skb fast clones.
    
    Then, we might experiment more easily alternative layouts.
    
    This patch adds a new skb_fclone_busy() helper, used by tcp and xfrm,
    to stop leaking of implementation details.
    
    Signed-off-by: Eric Dumazet <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 0f1ca65ee50df042051e8fa3a14f73b0c71d45b9
Author: Arianna Avanzini <[email protected]>
Date:   Fri Aug 22 13:20:02 2014 +0200

    xen, blkfront: factor out flush-related checks from do_blkif_request()
    
    This commit factors out some checks related to the request insertion
    path, which can be done in an function instead of by itself.
    
    Reviewed-by: David Vrabel <[email protected]>
    Signed-off-by: Arianna Avanzini <[email protected]>
    Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>

commit 61cecca865280bef4f8a9748d0a9afa5df351ac2
Author: Roger Pau Monné <[email protected]>
Date:   Mon Sep 15 11:55:27 2014 +0200

    xen-blkback: fix leak on grant map error path
    
    Fix leaking a page when a grant mapping has failed.
    
    CC: [email protected]
    Signed-off-by: Roger Pau Monné <[email protected]>
    Reported-and-Tested-by: Tao Chen <[email protected]>
    Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>

commit 12ea729645ace01e08f9654df155622898d3aae6
Author: Vitaly Kuznetsov <[email protected]>
Date:   Mon Sep 8 15:21:33 2014 +0200

    xen/blkback: unmap all persistent grants when frontend gets disconnected
    
    blkback does not unmap persistent grants when frontend goes to Closed
    state (e.g. when blkfront module is being removed). This leads to the
    following in guest's dmesg:
    
    [  343.243825] xen:grant_table: WARNING: g.e. 0x445 still in use!
    [  343.243825] xen:grant_table: WARNING: g.e. 0x42a still in use!
    ...
    
    When load module -> use device -> unload module sequence is performed multiple times
    it is possible to hit BUG() condition in blkfront module:
    
    [  343.243825] kernel BUG at drivers/block/xen-blkfront.c:954!
    [  343.243825] invalid opcode: 0000 [#1] SMP
    [  343.243825] Modules linked in: xen_blkfront(-) ata_generic pata_acpi [last unloaded: xen_blkfront]
    ...
    [  343.243825] Call Trace:
    [  343.243825]  [<ffffffff814111ef>] ? unregister_xenbus_watch+0x16f/0x1e0
    [  343.243825]  [<ffffffffa0016fbf>] blkfront_remove+0x3f/0x140 [xen_blkfront]
    ...
    [  343.243825] RIP  [<ffffffffa0016aae>] blkif_free+0x34e/0x360 [xen_blkfront]
    [  343.243825]  RSP <ffff88001eb8fdc0>
    
    We don't need to keep these grants if we're disconnecting as frontend might already
    forgot about them. Solve the issue by moving xen_blkbk_free_caches() call from
    xen_blkif_free() to xen_blkif_disconnect().
    
    Now we can see the following:
    [  928.590893] xen:grant_table: WARNING: g.e. 0x587 still in use!
    [  928.591861] xen:grant_table: WARNING: g.e. 0x372 still in use!
    ...
    [  929.592146] xen:grant_table: freeing g.e. 0x587
    [  929.597174] xen:grant_table: freeing g.e. 0x372
    ...
    
    Backend does not keep persistent grants any more, reconnect works fine.
    
    CC: [email protected]
    Signed-off-by: Vitaly Kuznetsov <[email protected]>
    Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>

commit b248230c34970a6c1c17c591d63b464e8d2cfc33
Author: Yuchung Cheng <[email protected]>
Date:   Mon Sep 29 13:20:38 2014 -0700

    tcp: abort orphan sockets stalling on zero window probes
    
    Currently we have two different policies for orphan sockets
    that repeatedly stall on zero window ACKs. If a socket gets
    a zero window ACK when it is transmitting data, the RTO is
    used to probe the window. The socket is aborted after roughly
    tcp_orphan_retries() retries (as in tcp_write_timeout()).
    
    But if the socket was idle when it received the zero window ACK,
    and later wants to send more data, we use the probe timer to
    probe the window. If the receiver always returns zero window ACKs,
    icsk_probes keeps getting reset in tcp_ack() and the orphan socket
    can stall forever until the system reaches the orphan limit (as
    commented in tcp_probe_timer()). This opens up a simple attack
    to create lots of hanging orphan sockets to burn the memory
    and the CPU, as demonstrated in the recent netdev post "TCP
    connection will hang in FIN_WAIT1 after closing if zero window is
    advertised." http://www.spinics.net/lists/netdev/msg296539.html
    
    This patch follows the design in RTO-based probe: we abort an orphan
    socket stalling on zero window when the probe timer reaches both
    the maximum backoff and the maximum RTO. For example, an 100ms RTT
    connection will timeout after roughly 153 seconds (0.3 + 0.6 +
    .... + 76.8) if the receiver keeps the window shut. If the orphan
    socket passes this check, but the system already has too many orphans
    (as in tcp_out_of_resources()), we still abort it but we'll also
    send an RST packet as the connection may still be active.
    
    In addition, we change TCP_USER_TIMEOUT to cover (life or dead)
    sockets stalled on zero-window probes. This changes the semantics
    of TCP_USER_TIMEOUT slightly because it previously only applies
    when the socket has pending transmission.
    
    Signed-off-by: Yuchung Cheng <[email protected]>
    Signed-off-by: Eric Dumazet <[email protected]>
    Signed-off-by: Neal Cardwell <[email protected]>
    Reported-by: Andrey Dmitrov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 3edfe0030bb7a82dab2a30a29ea6e1800e600c4b
Author: Helge Deller <[email protected]>
Date:   Wed Oct 1 22:11:01 2014 +0200

    parisc: Fix serial console for machines with serial port on superio chip
    
    Fix the serial console on machines where the serial port is located on
    the SuperIO chip.
    
    Signed-off-by: Helge Deller <[email protected]>
    Cc: Peter Hurley <[email protected]>

commit baf378126b08474de2e2428b16e62a69df0339d9
Author: Michael Opdenacker <[email protected]>
Date:   Wed Oct 1 14:07:39 2014 -0600

    rsxx: Remove deprecated IRQF_DISABLED
    
    This removes the use of the IRQF_DISABLED flag
    from drivers/block/rsxx/core.c
    
    It's a NOOP since 2.6.35 and it will be removed one day.
    
    Signed-off-by: Michael Opdenacker <[email protected]>
    Acked-by Philip Kelleher <[email protected]>
    Signed-off-by: Jens Axboe <[email protected]>

commit cb57659a15c6c0576493cc8a10474ce7ffd44eb3
Author: Fabian Frederick <[email protected]>
Date:   Wed Oct 1 19:30:03 2014 +0200

    cipso: add __init to cipso_v4_cache_init
    
    cipso_v4_cache_init is only called by __init cipso_v4_init
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 57a02c39c1c20ed03a86f8014c11a8c18b94cac3
Author: Fabian Frederick <[email protected]>
Date:   Wed Oct 1 19:18:57 2014 +0200

    inet: frags: add __init to ip4_frags_ctl_register
    
    ip4_frags_ctl_register is only called by __init ipfrag_init
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 47d7a88c188f06ffaea3a539f84fe10cb4e77787
Author: Fabian Frederick <[email protected]>
Date:   Wed Oct 1 18:27:50 2014 +0200

    tcp: add __init to tcp_init_mem
    
    tcp_init_mem is only called by __init tcp_init.
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit ee7a1beb9759c94aea67dd887faf5e447a5c6710
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:21 2014 +0800

    r8169:call "rtl8168_driver_start" "rtl8168_driver_stop" only when hardware dash function is enabled
    
    These two functions are used to inform dash firmware that driver is been
    brought up or brought down. So call these two functions only when hardware dash
    function is enabled.
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 2a9b4d9670e71784896d95c41c9b0acd50db1dbb
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:20 2014 +0800

    r8169:modify the behavior of function "rtl8168_oob_notify"
    
    In function "rtl8168_oob_notify", using function "rtl_eri_write" to access
    eri register 0xe8, instead of using MAC register "ERIDR" and "ERIAR" to
    access it.
    
    For using function "rtl_eri_write" in function "rtl8168_oob_notify", need to
    move down "rtl8168_oob_notify" related functions under the function
    "rtl_eri_write".
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 2f8c040ce6791ef0477e6d59768ee3d5fd0df0fd
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:19 2014 +0800

    r8169:change the name of function "r8168dp_check_dash" to "r8168_check_dash"
    
    DASH function not only RTL8168DP can support, but also RTL8168EP.
    So change the name of function "r8168dp_check_dash" to "r8168_check_dash".
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 706123d06c18b55da5e9da21e2d138ee789bf8f4
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:18 2014 +0800

    r8169:change the name of function"rtl_w1w0_eri"
    
    Change the name of function "rtl_w1w0_eri" to "rtl_w0w1_eri".
    
    In this function, the local variable "val" is "write zeros then write ones".
    Please see below code.
    
    (val & ~m) | p
    
    In this patch, change the function name from "xx_w1w0_xx" to "xx_w0w1_xx".
    The changed function name is more suitable for it's behavior.
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 7656442824f6174b56a19c664fe560972df56ad4
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:17 2014 +0800

    r8169:for function "rtl_w1w0_phy" change its name and behavior
    
    Change function name from "rtl_w1w0_phy" to "rtl_w0w1_phy".
    And its behavior from "write ones then write zeros" to
    "write zeros then write ones".
    
    In Realtek internal driver, bitwise operations are almost "write zeros then
    write ones". For easy to port hardware parameters from Realtek internal driver
    to Linux kernal driver "r8169", we would like to change this function's
    behavior and its name.
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit ac85bcdbc0ffd3903d6db4abcd769ecacf98605b
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:16 2014 +0800

    r8169:add more chips to support magic packet v2
    
    For RTL8168F RTL8168FB RTL8168G RTL8168GU RTL8411 RTL8411B RTL8402 RTL8107E,
    the magic packet enable bit is changed to eri 0xde bit0.
    
    In this patch, change magic packet enable bit of these chips to eri 0xde bit0.
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 89cceb2729c752e6ff9b3bc8650a70f29884f116
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:15 2014 +0800

    r8169:add support more chips to get mac address from backup mac address register
    
    RTL8168FB RTL8168G RTL8168GU RTL8411 RTL8411B RTL8106EUS RTL8402 can
    support get mac address from backup mac address register.
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 42fde7371035144037844f41bd16950de9912bdb
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:14 2014 +0800

    r8169:add disable/enable RTL8411B pll function
    
    RTL8411B can support disable/enable pll function.
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit b8e5e6ad7115befef13a4493f1d2b8e438abc058
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:13 2014 +0800

    r8169:add disable/enable RTL8168G pll function
    
    RTL8168G also can disable/enable pll function.
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 05b9687bb3606190304f08c2e4cd63de8717e30b
Author: Chun-Hao Lin <[email protected]>
Date:   Wed Oct 1 23:17:12 2014 +0800

    r8169:change uppercase number to lowercase number
    
    Signed-off-by: Chun-Hao Lin <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit a29c9c43bb633a9965909cd548879fee4aa789a4
Author: David L Stevens <[email protected]>
Date:   Wed Oct 1 11:05:27 2014 -0400

    sunvnet: fix potential NULL pointer dereference
    
    One of the error cases for vnet_start_xmit()'s "out_dropped" label
    is port == NULL, so only mess with port->clean_timer when port is not NULL.
    
    Signed-off-by: David L Stevens <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit e506d405ac7d34d03996c97ac68aa2ac010be64a
Author: Thierry Reding <[email protected]>
Date:   Wed Oct 1 13:59:00 2014 +0200

    net: dsa: Fix build warning for !PM_SLEEP
    
    The dsa_switch_suspend() and dsa_switch_resume() functions are only used
    when PM_SLEEP is enabled, so they need #ifdef CONFIG_PM_SLEEP protection
    to avoid a compiler warning.
    
    Signed-off-by: Thierry Reding <[email protected]>
    Acked-by: Florian Fainelli <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 84ac1f2ca41f5888cc995944c073a5220f3ed549
Author: Tanmay Inamdar <[email protected]>
Date:   Fri Sep 26 14:08:25 2014 -0700

    arm64: dts: Add APM X-Gene PCIe device tree nodes
    
    Add the device tree nodes for APM X-Gene PCIe host controller and PCIe
    clock interface.  Since X-Gene SOC supports maximum 5 ports, 5 dts nodes
    are added.
    
    Signed-off-by: Tanmay Inamdar <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 2896e4418b17363f211e084471b589e3c06a7248
Author: Bjorn Helgaas <[email protected]>
Date:   Wed Oct 1 13:01:35 2014 -0600

    PCI: xgene: Add APM X-Gene PCIe driver
    
    Add the AppliedMicro X-Gene SOC PCIe host controller driver.  The X-Gene
    PCIe controller supports up to 8 lanes and GEN3 speed.  The X-Gene SOC
    supports up to 5 PCIe ports.
    
    [bhelgaas: folded in MAINTAINERS and bindings updates]
    Tested-by: Ming Lei <[email protected]>
    Tested-by: Dann Frazier <[email protected]>
    Signed-off-by: Tanmay Inamdar <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Reviewed-by: Liviu Dudau <[email protected]> (driver)

commit 3c87dcbfb36ce6d3d9087f0163c02ba5690d9a85
Author: Subbaraya Sundeep Bhatta <[email protected]>
Date:   Wed Oct 1 11:01:17 2014 +0200

    net: ll_temac: Remove unnecessary ether_setup after alloc_etherdev
    
    Calling ether_setup is redundant since alloc_etherdev calls it.
    
    Signed-off-by: Subbaraya Sundeep Bhatta <[email protected]>
    Signed-off-by: Michal Simek <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 8493ecca74a7b4a66e19676de1a0f14194179941
Author: Benjamin Tissoires <[email protected]>
Date:   Wed Oct 1 11:59:47 2014 -0400

    HID: uHID: fix excepted report type
    
    When uhid_get_report() or uhid_set_report() are called, they emit on the
    char device a UHID_GET_REPORT or UHID_SET_REPORT message. Then, the
    protocol says that the user space asnwers with UHID_GET_REPORT_REPLY
    or UHID_SET_REPORT_REPLY.
    
    Unfortunatelly, the current code waits for an event of type UHID_GET_REPORT
    or UHID_SET_REPORT instead of the reply one.
    Add 1 to UHID_GET_REPORT or UHID_SET_REPORT to actually wait for the
    reply, and validate the reply.
    
    Signed-off-by: Benjamin Tissoires <[email protected]>
    Reviewed-by: David Herrmann <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>

commit c8df6ac9452e8f47a6f660993c526d13e858a6f3
Author: Lucas Stach <[email protected]>
Date:   Tue Sep 30 18:36:27 2014 +0200

    PCI: designware: Remove open-coded bitmap operations
    
    Replace them by using the standard kernel bitmap ops.  No functional
    change, but makes the code a lot cleaner.
    
    Signed-off-by: Lucas Stach <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Reviewed-by: Pratyush Anand <[email protected]>
    Acked-by: Jingoo Han <[email protected]>

commit 2199f0608864cf4e8c93d37842a5ee50c8d79843
Author: Mikulas Patocka <[email protected]>
Date:   Fri Mar 28 15:51:56 2014 -0400

    dm crypt: sort writes
    
    Write requests are sorted in a red-black tree structure and are
    submitted in the sorted order.
    
    In theory the sorting should be performed by the underlying disk
    scheduler, however, in practice the disk scheduler only accepts and
    sorts a finite number of requests.  To allow the sorting of all
    requests, dm-crypt needs to implement its own own sorting.
    
    The overhead associated with rbtree-based sorting is considered
    negligible so it is not used conditionally.  Even on SSD sorting can be
    beneficial since in-order request dispatch promotes lower latency IO
    completion to the upper layers.
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>

commit 648fee35be4c75667aa18bf513f7e7e65c01640b
Author: Mikulas Patocka <[email protected]>
Date:   Fri Mar 28 15:51:56 2014 -0400

    dm crypt: offload writes to thread
    
    Submitting write bios directly in the encryption thread caused serious
    performance degradation.  On a multiprocessor machine, encryption requests
    finish in a different order than they were submitted.  Consequently, write
    requests would be submitted in a different order and it could cause severe
    performance degradation.
    
    Move the submission of write requests to a separate thread so that the
    requests can be sorted before submitting.  But this commit improves
    dm-crypt performance even without having dm-crypt perform request
    sorting (in particular it enables IO schedulers like CFQ to sort more
    effectively).
    
    Note: it is required that a previous commit ("dm crypt: don't allocate
    pages for a partial request") be applied before applying this patch.
    Otherwise, this commit could introduce a crash.
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>

commit 4a0d7e0464226eee625a5b77484c339334453882
Author: Mikulas Patocka <[email protected]>
Date:   Fri Mar 28 15:51:55 2014 -0400

    dm crypt: use unbound workqueue for request processing
    
    Use unbound workqueue so that work is automatically balanced between
    available CPUs.
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>

commit 72bfc40ca3b393cb0bc6b5e2ce364e6c6ce0f390
Author: Mikulas Patocka <[email protected]>
Date:   Thu May 29 14:18:12 2014 -0400

    dm crypt: remove io_pending refcount member from dm_crypt_io
    
    Commit "dm crypt: don't allocate pages for a partial request" changed
    the code to allocate all pages for one request.  There is always just
    one pending request, so the io_pending refcount may be removed.
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>

commit 42196fec8945cc84c032b7f59deaffee82036245
Author: Mikulas Patocka <[email protected]>
Date:   Fri Mar 28 15:51:56 2014 -0400

    dm crypt: remove unused io_pool and _crypt_io_pool
    
    The previous commits ("dm crypt: use per-bio data") and ("dm crypt:
    don't allocate pages for a partial request") stopped using the
    io_pool slab mempool and backing _crypt_io_pool kmem cache.
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>

commit ebfda24b1e1bf483accdb900f8625151d8f01383
Author: Mikulas Patocka <[email protected]>
Date:   Fri Mar 28 15:51:56 2014 -0400

    dm crypt: avoid deadlock in mempools
    
    Fix a theoretical deadlock introduced in the previous commit ("dm crypt:
    don't allocate pages for a partial request").
    
    The function crypt_alloc_buffer may be called concurrently.  If we allocate
    from the mempool concurrently, there is a possibility of deadlock.  For
    example, if we have mempool of 256 pages, two processes, each wanting
    256, pages allocate from the mempool concurrently, it may deadlock in a
    situation where both processes have allocated 128 pages and the mempool
    is exhausted.
    
    In order to avoid such a scenario, we allocate the pages under a mutex.
    
    In order to not degrade performance with excessive locking, we try
    non-blocking allocations without a mutex first and if it fails, we
    fallback to a blocking allocation with a mutex.
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>

commit b9ea7cb3fb237078be400522880932008c630fb7
Author: Mikulas Patocka <[email protected]>
Date:   Fri Mar 28 15:51:56 2014 -0400

    dm crypt: don't allocate pages for a partial request
    
    Change crypt_alloc_buffer so that it only ever allocates pages for a
    full request.
    
    This change is a prerequisite for the commit "dm crypt: offload writes
    to thread".  Which implies this change is effectively required for the
    upcoming cpu parallelization changes.
    
    But this change simplifies the dm-crypt code at the expense of reduced
    throughput in low memory conditions (where allocation for a partial
    request is most useful).
    
    This change also enables the removal of the io_pending refcount.
    
    Note: the next commit ("dm-crypt: avoid deadlock in mempools") is needed
    to fix a theoretical deadlock.
    
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>

commit 117cd3e12232afea97dd31489fbde8888ad22b3e
Author: Heinz Mauelshagen <[email protected]>
Date:   Wed Sep 24 17:47:19 2014 +0200

    dm raid: add discard support for RAID levels 4, 5 and 6
    
    In case of RAID levels 4, 5 and 6 we have to verify each RAID members'
    ability to zero data on discards to avoid stripe data corruption -- if
    discard_zeroes_data is not set for each RAID member discard support must
    be disabled.
    
    Also add an 'ignore_discard' table argument to the target in order to
    ignore discard processing completely on a RAID array, hence not passing
    down discards to MD personalities.
    
    This 'ignore_discard' control provides the ability to:
    - prohibit discards in case of _potential_ data corruptions in RAID4/5/6
      (e.g. if ability to zero data on discard is flawed in a RAID member)
    - avoid discard processing overhead
    
    Signed-off-by: Heinz Mauelshagen <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>

commit 04c308f43a90a9b3b84c344b324d6af29288da05
Author: Mikulas Patocka <[email protected]>
Date:   Wed Oct 1 13:29:48 2014 -0400

    dm bufio: when done scanning return from __scan immediately
    
    When __scan frees the required number of buffer entries that the
    shrinker requested (nr_to_scan becomes zero) it must return.  Before
    this fix the __scan code exited only the inner loop and continued in the
    outer loop.
    
    Also, move dm_bufio_cond_resched to __scan's inner loop, so that
    iterating the bufio client's lru lists doesn't result in scheduling
    latency.
    
    Reported-by: Joe Thornber <[email protected]>
    Signed-off-by: Mikulas Patocka <[email protected]>
    Signed-off-by: Mike Snitzer <[email protected]>
    Cc: [email protected] # 3.2+

commit 5ec094057c7df5ff80f5e7fe282f47ad205fb976
Author: Bjorn Helgaas <[email protected]>
Date:   Tue Sep 23 14:38:28 2014 -0600

    PCI/MSI: Remove unnecessary temporary variable
    
    The only use of "status" is to hold a value which is immediately returned,
    so just return and remove the variable directly.
    
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 56b72b40957947f7c08771f030102351d4c906df
Author: Yijing Wang <[email protected]>
Date:   Mon Sep 29 18:35:16 2014 -0600

    PCI/MSI: Use __write_msi_msg() instead of write_msi_msg()
    
    default_restore_msi_irq() already has the struct msi_desc pointer required
    by __write_msi_msg(), so call it directly instead of having write_msi_msg()
    look it up from the IRQ.
    
    No functional change.
    
    [bhelgaas: split into separate patch]
    Signed-off-by: Yijing Wang <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 1e8f4cc82eded0c3c97ef6e2f119782e42deda35
Author: Yijing Wang <[email protected]>
Date:   Wed Sep 24 11:09:45 2014 +0800

    MSI/powerpc: Use __read_msi_msg() instead of read_msi_msg()
    
    rtas_setup_msi_irqs() already has the struct msi_desc pointer required by
    __read_msi_msg(), so call it directly instead of having read_msi_msg() look
    it up from the IRQ.
    
    No functional change.
    
    [bhelgaas: changelog]
    Signed-off-by: Yijing Wang <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Acked-by: Michael Ellerman <[email protected]>
    CC: Benjamin Herrenschmidt <[email protected]>
    CC: [email protected]

commit 2b260085e466c345e78f23b1c9ad1d123d509ef8
Author: Yijing Wang <[email protected]>
Date:   Tue Sep 23 13:27:25 2014 +0800

    PCI/MSI: Use __get_cached_msi_msg() instead of get_cached_msi_msg()
    
    Both callers of get_cached_msi_msg() start with a struct irq_data pointer,
    look up the corresponding IRQ number, and pass it to get_cached_msi_msg(),
    which then uses irq_get_irq_data() to look up the struct irq_data again to
    call __get_cached_msi_msg().
    
    Since we already have the struct irq_data, call __get_cached_msi_msg()
    directly and skip the lookup work done by get_cached_msi_msg().
    
    No functional change.
    
    [bhelgaas: changelog]
    Signed-off-by: Yijing Wang <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    CC: Tony Luck <[email protected]>
    CC: [email protected]

commit 468ff15a3ab98ed7153c29c68229ffb97f15a251
Author: Yijing Wang <[email protected]>
Date:   Tue Sep 23 13:27:24 2014 +0800

    PCI/MSI: Add "msi_bus" sysfs MSI/MSI-X control for endpoints
    
    The "msi_bus" sysfs file for bridges sets a bus flag to allow or disallow
    future driver requests for MSI or MSI-X.  Previously, the sysfs file
    existed for endpoints but did nothing.
    
    Add "msi_bus" support for endpoints, so an administrator can prevent the
    use of MSI and MSI-X for individual devices.
    
    Note that as for bridges, these changes only affect future driver requests
    for MSI or MSI-X, so drivers may need to be reloaded.
    
    Add documentation for the "msi_bus" sysfs file.
    
    [bhelgaas: changelog, comments, add "subordinate", add endpoint printk,
    rework bus_flags setting, make bus_flags printk unconditional]
    Signed-off-by: Yijing Wang <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 48c3c38f003c25d50a09d3da558667c5ecd530aa
Author: Yijing Wang <[email protected]>
Date:   Tue Sep 23 11:02:42 2014 -0600

    PCI/MSI: Remove "pos" from the struct msi_desc msi_attrib
    
    "msi_attrib.pos" is only used for MSI (not MSI-X), and we already cache the
    MSI capability offset in "dev->msi_cap".
    
    Remove "pos" from the struct msi_attrib and use "dev->msi_cap" directly.
    
    [bhelgaas: changelog, fix whitespace]
    Signed-off-by: Yijing Wang <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 81052769e48609525c452d8f078a5786b673e178
Author: Yijing Wang <[email protected]>
Date:   Tue Sep 23 13:27:22 2014 +0800

    PCI/MSI: Remove unused kobject from struct msi_desc
    
    After commit 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not
    kobjects"), the kobject in struct msi_desc is unused.
    
    Remove the unused struct kobject from struct msi_desc.
    
    [bhelgaas: changelog]
    Fixes: 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not kobjects")
    Signed-off-by: Yijing Wang <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Acked-by: Greg Kroah-Hartman <[email protected]>

commit a06cd74cefe754341f747ddc4cf7b0058fa9bff8
Author: Alexander Gordeev <[email protected]>
Date:   Tue Sep 23 12:45:58 2014 -0600

    PCI/MSI: Rename pci_msi_check_device() to pci_msi_supported()
    
    Rename pci_msi_check_device() to pci_msi_supported() for clarity.  Note
    that pci_msi_supported() returns true if MSI/MSI-X is supported, so code
    like:
    
      if (pci_msi_supported(...))
    
    reads naturally.
    
    [bhelgaas: changelog, split to separate patch, reverse sense]
    Signed-off-by: Alexander Gordeev <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 27e20603c54ba633ed259284d006275f13c9f95b
Author: Alexander Gordeev <[email protected]>
Date:   Tue Sep 23 14:25:11 2014 -0600

    PCI/MSI: Move D0 check into pci_msi_check_device()
    
    Both callers of pci_msi_check_device() check that the device is in D0
    state, so move the check from the callers into pci_msi_check_device()
    itself.
    
    In pci_enable_msi_range(), note that pci_msi_check_device() never returns a
    positive value any more, so the loop that called it until it returns zero
    or negative is no longer necessary.
    
    [bhelgaas: changelog, split to separate patch]
    Signed-off-by: Alexander Gordeev <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit ad975ebad4c3ce8dcc7d0bb4db26ea5aca4cfc99
Author: Alexander Gordeev <[email protected]>
Date:   Tue Sep 23 12:39:54 2014 -0600

    PCI/MSI: Remove arch_msi_check_device()
    
    No architectures implement arch_msi_check_device() or the struct msi_chip
    .check_device() method, so remove them.
    
    Remove the "type" parameter to pci_msi_check_device() because it was only
    used to call arch_msi_check_device() and is no longer needed.
    
    [bhelgaas: changelog, split to separate patch]
    Signed-off-by: Alexander Gordeev <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>

commit 3930115e0dd67f61b3b1882c7a34d0baeff1bb4c
Author: Alexander Gordeev <[email protected]>
Date:   Sun Sep 7 20:57:54 2014 +0200

    irqchip: armada-370-xp: Remove arch_msi_check_device()
    
    Move MSI checks from arch_msi_check_device() to arch_setup_msi_irqs().
    This makes the code more compact and allows removing
    arch_msi_check_device() from generic MSI code.
    
    Tested-by: Thomas Petazzoni <[email protected]>
    Signed-off-by: Alexander Gordeev <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Acked-by: Jason Cooper <[email protected]>
    CC: Thomas Gleixner <[email protected]>

commit 6b2fd7efeb888fa781c1f767de6c36497ac1596b
Author: Alexander Gordeev <[email protected]>
Date:   Sun Sep 7 20:57:53 2014 +0200

    PCI/MSI/PPC: Remove arch_msi_check_device()
    
    Move MSI checks from arch_msi_check_device() to arch_setup_msi_irqs().
    This makes the code more compact and allows removing
    arch_msi_check_device() from generic MSI code.
    
    Signed-off-by: Alexander Gordeev <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Acked-by: Michael Ellerman <[email protected]>

commit 977104ece1568f2e2ad3f5fd8e55bd640e8ab55a
Author: Mark Charlebois <[email protected]>
Date:   Thu Sep 4 14:16:17 2014 -0700

    arm: LLVMLinux: Use global stack register variable for percpu
    
    Using global current_stack_pointer works on both clang and gcc.
    current_stack_pointer is an unsigned long and needs to be cast
    as a pointer to dereference.
    
    KernelVersion: 3.17.0-rc6
    Signed-off-by: Mark Charlebois <[email protected]>
    Signed-off-by: Behan Webster <[email protected]>

commit a35dc594542b29935cd3a92e53233ad4ba4e622f
Author: Behan Webster <[email protected]>
Date:   Tue Sep 3 22:27:27 2013 -0400

    arm: LLVMLinux: Use current_stack_pointer in unwind_backtrace
    
    Use the global current_stack_pointer to get the value of the stack pointer.
    This change supports being able to compile the kernel with both gcc and clang.
    
    KernelVersion: 3.17.0-rc6
    Signed-off-by: Behan Webster <[email protected]>
    Reviewed-by: Mark Charlebois <[email protected]>
    Reviewed-by: Jan-Simon Möller <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Acked-by: Nicolas Pitre <[email protected]>

commit 5c5da6724d8e1767405a3f4b611451a11ece99e2
Author: Behan Webster <[email protected]>
Date:   Tue Sep 3 22:27:27 2013 -0400

    arm: LLVMLinux: Calculate current_thread_info from current_stack_pointer
    
    Use the global current_stack_pointer to get the value of the stack pointer.
    This change supports being able to compile the kernel with both gcc and clang.
    
    KernelVersion: 3.17.0-rc6
    Signed-off-by: Behan Webster <[email protected]>
    Reviewed-by: Mark Charlebois <[email protected]>
    Reviewed-by: Jan-Simon Möller <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Acked-by: Nicolas Pitre <[email protected]>

commit f2b6d8c6c56c9a164a2d885ba34a09d613c959c9
Author: Behan Webster <[email protected]>
Date:   Tue Sep 3 22:27:27 2013 -0400

    arm: LLVMLinux: Use current_stack_pointer in save_stack_trace_tsk
    
    Use the global current_stack_pointer to get the value of the stack pointer.
    This change supports being able to compile the kernel with both gcc and clang.
    
    KernelVersion: 3.17.0-rc6
    Signed-off-by: Behan Webster <[email protected]>
    Reviewed-by: Mark Charlebois <[email protected]>
    Reviewed-by: Jan-Simon Möller <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Acked-by: Nicolas Pitre <[email protected]>

commit 40802b84566a3d9731a8fea43b144301d9ac450d
Author: Behan Webster <[email protected]>
Date:   Tue Sep 3 22:27:27 2013 -0400

    arm: LLVMLinux: Use current_stack_pointer for return_address
    
    Use the global current_stack_pointer to get the value of the stack pointer.
    This change supports being able to compile the kernel with both gcc and Clang.
    
    KernelVersion: 3.17.0-rc6
    Signed-off-by: Behan Webster <[email protected]>
    Reviewed-by: Mark Charlebois <[email protected]>
    Reviewed-by: Jan-Simon Möller <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Acked-by: Nicolas Pitre <[email protected]>

commit d80ced5236764b8c4ffda5545d5b357cf88c77c1
Author: Behan Webster <[email protected]>
Date:   Tue Sep 3 22:27:27 2013 -0400

    arm: LLVMLinux: Use current_stack_pointer to calculate pt_regs address
    
    Use the global current_stack_pointer to calculate the end of the stack for
    current_pt_regs()
    
    KernelVersion: 3.17.0-rc6
    Signed-off-by: Behan Webster <[email protected]>
    Reviewed-by: Mark Charlebois <[email protected]>
    Reviewed-by: Jan-Simon Möller <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Acked-by: Nicolas Pitre <[email protected]>

commit 9d0d6994806b36891453beb1e94b6253f853af61
Author: Behan Webster <[email protected]>
Date:   Tue Sep 3 22:27:26 2013 -0400

    arm: LLVMLinux: Add global named register current_stack_pointer for ARM
    
    Define a global named register for current_stack_pointer. The use of this new
    variable guarantees that both gcc and clang can access this register in C code.
    
    KernelVersion: 3.17.0-rc6
    Signed-off-by: Behan Webster <[email protected]>
    Reviewed-by: Jan-Simon Möller <[email protected]>
    Reviewed-by: Mark Charlebois <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Acked-by: Nicolas Pitre <[email protected]>

commit 2c804d0f8fc7799981d9fdd8c88653541b28c1a7
Author: Eric Dumazet <[email protected]>
Date:   Tue Sep 30 22:12:05 2014 -0700

    ipv4: mentions skb_gro_postpull_rcsum() in inet_gro_receive()
    
    Proper CHECKSUM_COMPLETE support needs to adjust skb->csum
    when we remove one header. Its done using skb_gro_postpull_rcsum()
    
    In the case of IPv4, we know that the adjustment is not really needed,
    because the checksum over IPv4 header is 0. Lets add a comment to
    ease code comprehension and avoid copy/paste errors.
    
    Signed-off-by: Eric Dumazet <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit eb51bbaf8dedf142a54a7ff58514a29b40d515bb
Author: Stephen Rothwell <[email protected]>
Date:   Wed Oct 1 17:00:49 2014 +1000

    fm10k: using vmalloc requires including linux/vmalloc.h
    
    Signed-off-by: Stephen Rothwell <[email protected]>
    Acked-by: Jeff Kirsher <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 078efae00ffc76381c3248006e9cf0988163488f
Author: Anish Bhatt <[email protected]>
Date:   Mon Sep 15 17:44:18 2014 -0700

    [SCSI] cxgb4i: avoid holding mutex in interrupt context
    
    cxgbi_inet6addr_handler() can be called in interrupt context, so use rcu
    protected list while finding netdev.  This is observed as a scheduling in
    atomic oops when running over ipv6.
    
    Fixes: fc8d0590d914 ("libcxgbi: Add ipv6 api to driver")
    Fixes: 759a0cc5a3e1 ("cxgb4i: Add ipv6 code to driver, call into libcxgbi ipv6 api")
    
    Signed-off-by: Anish Bhatt <[email protected]>
    Signed-off-by: Karen Xie <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>
    Signed-off-by: James Bottomley <[email protected]>

commit 34549ab09e62db9703811c6ed4715f2ffa1fd7fb
Author: Jeff Layton <[email protected]>
Date:   Wed Oct 1 08:05:22 2014 -0400

    nfsd: eliminate "to_delegation" define
    
    We now have cb_to_delegation and to_delegation, which do the same thing
    and are defined separately in different .c files. Move the
    cb_to_delegation definition into a header file and eliminate the
    redundant to_delegation definition.
    
    Reviewed-by: Christoph Hellwig <[email protected]>
    Signed-off-by: Jeff Layton <[email protected]>

commit 4a0efdc933680d908de11712a774a2c9492c3d5a
Author: Hannes Reinecke <[email protected]>
Date:   Wed Oct 1 14:32:31 2014 +0200

    block: misplaced rq_complete tracepoint
    
    The rq_complete tracepoint was never issued for empty requests,
    causing the resulting blktrace information to never show any
    completion for those request.
    
    Signed-off-by: Hannes Reinecke <[email protected]>
    Acked-by: Tejun Heo <[email protected]>
    Signed-off-by: Jens Axboe <[email protected]>

commit fc2021fb9baf9ed375c8161b40b68e120e75c60e
Author: Michael Opdenacker <[email protected]>
Date:   Wed Oct 1 12:07:07 2014 +0200

    block: hd: remove deprecated IRQF_DISABLED
    
    This patch removes the use of the IRQF_DISABLED flag
    from drivers/block/hd.c
    
    It's a NOOP since 2.6.35 and it will be removed one day.
    
    This also removes a related comment which is obsolete too.
    
    Signed-off-by: Michael Opdenacker <[email protected]>
    Signed-off-by: Jens Axboe <[email protected]>

commit 19aeb5a65f1a6504fc665466c188241e7393d66f
Author: Bob Peterson <[email protected]>
Date:   Mon Sep 29 08:52:04 2014 -0400

    GFS2: Make rename not save dirent location
    
    This patch fixes a regression in the patch "GFS2: Remember directory
    insert point", commit 2b47dad866d04f14c328f888ba5406057b8c7d33.
    The problem had to do with the rename function: The function found
    space for the new dirent, and remembered that location. But then the
    old dirent was removed, which often moved the eligible location for
    the renamed dirent. Putting the new dirent at the saved location
    caused file system corruption.
    
    This patch adds a new "save_loc" variable to struct gfs2_diradd.
    If 1, the dirent location is saved. If 0, the dirent location is not
    saved and the buffer_head is released as per previous behavior.
    
    Signed-off-by: Bob Peterson <[email protected]>
    Signed-off-by: Steven Whitehouse <[email protected]>

commit 5235166fbc332c8b5dcf49e3a498a8b510a77449
Author: Oliver Neukum <[email protected]>
Date:   Tue Sep 30 12:54:56 2014 +0200

    HID: usbhid: add another mouse that needs QUIRK_ALWAYS_POLL
    
    There is a second mouse sharing the same vendor strings but different IDs.
    
    Signed-off-by: Oliver Neukum <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>

commit 2013add4ce73c93ae2148969a9ec3ecc8b1e26fa
Author: Gavin Shan <[email protected]>
Date:   Wed Oct 1 14:34:51 2014 +1000

    powerpc/eeh: Show hex prefix for PE state sysfs
    
    As Michael suggested, the hex prefix for the output of EEH PE
    state sysfs entry (/sys/bus/pci/devices/xxx/eeh_pe_state) is
    always informative to users.
    
    Suggested-by: Michael Ellerman <[email protected]>
    Signed-off-by: Gavin Shan <[email protected]>
    Signed-off-by: Michael Ellerman <[email protected]>

commit 24c20f10583647e30afe87b6f6d5e14bc7b1cbc6
Author: Christoph Hellwig <[email protected]>
Date:   Tue Sep 30 16:43:46 2014 +0200

    scsi: add a CONFIG_SCSI_MQ_DEFAULT option
    
    Add a Kconfig option to enable the blk-mq path for SCSI by default
    to ease testing and deployment in setups that know they benefit
    from blk-mq.
    
    Signed-off-by: Christoph Hellwig <[email protected]>
    Reviewed-by: Martin K. Petersen <[email protected]>
    Reviewed-by: Robert Elliott <[email protected]>
    Tested-by: Robert Elliott <[email protected]>

commit e785060ea3a1c8e37a8bc1449c79e36bff2b5b13
Author: Dolev Raviv <[email protected]>
Date:   Thu Sep 25 15:32:36 2014 +0300

    ufs: definitions for phy interface
    
    - Adding some of the definitions missing in unipro.h, including power
      enumeration.
    - Read Modify Write Line helper function
    - Indication for the type of suspend
    
    Signed-off-by: Dolev Raviv <[email protected]>
    Signed-off-by: Subhash Jadavani <[email protected]>
    Signed-off-by: Yaniv Gardi <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>

commit 374a246e4ebda1fc55d537877bf2412e511ecc7b
Author: Subhash Jadavani <[email protected]>
Date:   Thu Sep 25 15:32:35 2014 +0300

    ufs: tune bkops while power managment events
    
    Add capability to control the auto bkops during suspend.
    If host explicitly enables the auto bkops (background operation) on device
    then only device would perform the bkops on its own. If auto bkops is not
    enabled explicitly and if the device reaches to state where it must do
    background operation, device would raise the urgent bkops exception event
    to host and then host will enable the auto bkops on device. This patch
    adds the option to choose whether auto bkops should be enabled during
    runtime suspend or not. Since we don't want to keep the device active to
    perform the non critical bkops, host will enable urgent bkops only.
    
    Keep auto-bkops enabled after resume if urgent bkops needed.
    If device bkops status shows that its in critical need of executing
    background operations, host should allow the device to continue doing
    background operations.
    
    Signed-off-by: Subhash Jadavani <[email protected]>
    Signed-off-by: Dolev Raviv <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>

commit 856b348305c98d4e0c8e5eafa97c61443197f8d3
Author: Sahitya Tummala <[email protected]>
Date:   Thu Sep 25 15:32:34 2014 +0300

    ufs: Add support for clock scaling using devfreq framework
    
    The clocks for UFS device will be managed by generic DVFS (Dynamic
    Voltage and Frequency Scaling) framework within kernel. This devfreq
    framework works with different governors to scale the clocks. By default,
    UFS devices uses simple_ondemand governor which scales the clocks up if
    the load is more than upthreshold and scales down if the load is less than
    downthreshold.
    
    Signed-off-by: Sahitya Tummala <[email protected]>
    Signed-off-by: Dolev Raviv <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>

commit 4cff6d991e4a291cf50fe2659da2ea9ad46620bf
Author: Sahitya Tummala <[email protected]>
Date:   Thu Sep 25 15:32:33 2014 +0300

    ufs: Add freq-table-hz property for UFS device
    
    Add freq-table-hz propery for UFS device to keep track of
    <min max> frequencies supported by UFS clocks.
    
    Signed-off-by: Sahitya Tummala <[email protected]>
    Signed-off-by: Dolev Raviv <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>

commit 1ab27c9cf8b63dd8dec9e17b5c17721c7f3b6cc7
Author: Sahitya Tummala <[email protected]>
Date:   Thu Sep 25 15:32:32 2014 +0300

    ufs: Add support for clock gating
    
    The UFS controller clocks can be gated after certain period of
    inactivity, which is typically less than runtime suspend timeout.
    In addition to clocks the link will also be put into Hibern8 mode
    to save more power.
    
    The clock gating can be turned on by enabling the capability
    UFSHCD_CAP_CLK_GATING. To enable entering into Hibern8 mode as part of
    clock gating, set the capability UFSHCD_CAP_HIBERN8_WITH_CLK_GATING.
    
    The tracing events for clock gating can be enabled through debugfs as:
    echo 1 > /sys/kernel/debug/tracing/events/ufs/ufshcd_clk_gating/enable
    cat /sys/kernel/debug/tracing/trace_pipe
    
    Signed-off-by: Sahitya Tummala <[email protected]>
    Signed-off-by: Dolev Raviv <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>

commit 7eb584db73bebbc9852a14341431ed6935419bec
Author: Dolev Raviv <[email protected]>
Date:   Thu Sep 25 15:32:31 2014 +0300

    ufs: refactor configuring power mode
    
    Sometimes, the device shall report its maximum power and speed
    capabilities, but we might not wish to configure it to use those
    maximum capabilities.
    This change adds support for the vendor specific host driver to
    implement power change notify callback.
    
    To enable configuring different power modes (number of lanes,
    gear number and fast/slow modes) it is necessary to split the
    configuration stage from the stage that reads the device max power mode.
    In addition, it is not required to read the configuration more than
    once, thus the configuration is stored after reading it once.
    
    Signed-off-by: Dolev Raviv <[email protected]>
    Signed-off-by: Yaniv Gardi <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>

commit 57d104c153d3d6d7bea60089e80f37501851ed2c
Author: Subhash Jadavani <[email protected]>
Date:   Thu Sep 25 15:32:30 2014 +0300

    ufs: add UFS power management support
    
    This patch adds support for UFS device and UniPro link power management
    during runtime/system PM.
    
    Main idea is to define multiple UFS low power levels based on UFS device
    and UFS link power states. This would allow any specific platform or pci
    driver to choose the best suited low power level during runtime and
    system suspend based on their power goals.
    
    bkops handlig:
    To put the UFS device in sleep state when bkops is disabled, first query
    the bkops status from the device and enable bkops on device only if
    device needs time to perform the bkops.
    
    START_STOP handling:
    Before sending START_STOP_UNIT to the device well-known logical unit
    (w-lun) to make sure that the device w-lun unit attention condition is
    cleared.
    
    Write protection:
    UFS device specification allows LUs to be write protected, either
    permanently or power on write protected. If any LU is power on write
    protected and if the card is power cycled (by powering off VCCQ and/or
    VCC rails), LU's write protect status would be lost. So this means those
    LUs can be written now. To ensures that UFS device is power cycled only
    if the power on protect is not set for any of the LUs, check if power on
    write protect is set and if device is in sleep/power-off state & link in
    inactive state (Hibern8 or OFF state).
    If none of the Logical Units on UFS device is power on write protected
    then all UFS device power rails (VCC, VCCQ & VCCQ2) can be turned off if
    UFS device is in power-off state and UFS link is in OFF state. But current
    implementation would disable all device power rails even if UFS link is
    not in OFF state.
    
    Low power mode:
    If UFS link is in OFF state then UFS host controller can be power collapsed
    to avoid leakage current from it. Note that if UFS host controller is power
    collapsed, full UFS reinitialization will be required on resume to
    re-establish the link between host and device.
    
    Signed-off-by: Subhash Jadavani <[email protected]>
    Signed-off-by: Dolev Raviv <[email protected]>
    Signed-off-by: Sujit Reddy Thumma <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>

commit 0ce147d48a3e3352859f0c185e98e8392bee7a25
Author: Subhash Jadavani <[email protected]>
Date:   Thu Sep 25 15:32:29 2014 +0300

    ufs: introduce well known logical unit in ufs
    
    UFS device may have standard LUs and LUN id could be from 0x00 to 0x7F.
    UFS device specification use "Peripheral Device Addressing Format"
    (SCSI SAM-5) for standard LUs.
    
    UFS device may also have the Well Known LUs (also referred as W-LU) which
    again could be from 0x00 to 0x7F. For W-LUs, UFS device specification only
    allows the "Extended Addressing Format" (SCSI SAM-5) which means the W-LUNs
    would start from 0xC100 onwards.
    
    This means max. LUN number reported from UFS device could be 0xC17F hence
    this patch advertise the "max_lun" as 0xC17F which will allow SCSI mid
    layer to detect the W-LUs as well.
    
    But once the W-LUs are detected, UFSHCD driver may get the commands with
    SCSI LUN id upto 0xC17F but UPIU LUN id field is only 8-bit wide so it
    requires the mapping of SCSI LUN id to UPIU LUN id. This patch also add
    support for this mapping.
    
    Signed-off-by: Subhash Jadavani <[email protected]>
    Signed-off-by: Dolev Raviv <[email protected]>
    Signed-off-by: Sujit Reddy Thumma <[email protected]>
    Signed-off-by: Christoph Hellwig <[email protected]>

commit 2a8fa600445c45222632810a4811ce820279d106
Author: Subhash Jadavani <su…
kernelOfTruth pushed a commit to kernelOfTruth/linux that referenced this pull request Nov 8, 2014
@kernelOfTruth
[PATCH V2] aio: fix uncorrent dirty pages accouting when truncating A…
8cb1e0e 
…IO ring buffer

https://bugzilla.kernel.org/show_bug.cgi?id=86831

Markus reported that when shutting down mysqld (with AIO support,
on a ext3 formatted Harddrive) leads to a negative number of dirty pages
(underrun to the counter). The negative number results in a drastic reduction
of the write performance because the page cache is not used, because the kernel
thinks it is still 2 ^ 32 dirty pages open.

Add a warn trace in __dec_zone_state will catch this easily:

static inline void __dec_zone_state(struct zone *zone, enum
	zone_stat_item item)
{
     atomic_long_dec(&zone->vm_stat[item]);
+    WARN_ON_ONCE(item == NR_FILE_DIRTY &&
	atomic_long_read(&zone->vm_stat[item]) < 0);
     atomic_long_dec(&vm_stat[item]);
}

[   21.341632] ------------[ cut here ]------------
[   21.346294] WARNING: CPU: 0 PID: 309 at include/linux/vmstat.h:242
cancel_dirty_page+0x164/0x224()
[   21.355296] Modules linked in: wutbox_cp sata_mv
[   21.359968] CPU: 0 PID: 309 Comm: kworker/0:1 Not tainted 3.14.21-WuT torvalds#80
[   21.366793] Workqueue: events free_ioctx
[   21.370760] [<c0016a64>] (unwind_backtrace) from [<c0012f88>]
(show_stack+0x20/0x24)
[   21.378562] [<c0012f88>] (show_stack) from [<c03f8ccc>]
(dump_stack+0x24/0x28)
[   21.385840] [<c03f8ccc>] (dump_stack) from [<c0023ae4>]
(warn_slowpath_common+0x84/0x9c)
[   21.393976] [<c0023ae4>] (warn_slowpath_common) from [<c0023bb8>]
(warn_slowpath_null+0x2c/0x34)
[   21.402800] [<c0023bb8>] (warn_slowpath_null) from [<c00c0688>]
(cancel_dirty_page+0x164/0x224)
[   21.411524] [<c00c0688>] (cancel_dirty_page) from [<c00c080c>]
(truncate_inode_page+0x8c/0x158)
[   21.420272] [<c00c080c>] (truncate_inode_page) from [<c00c0a94>]
(truncate_inode_pages_range+0x11c/0x53c)
[   21.429890] [<c00c0a94>] (truncate_inode_pages_range) from
[<c00c0f6c>] (truncate_pagecache+0x88/0xac)
[   21.439252] [<c00c0f6c>] (truncate_pagecache) from [<c00c0fec>]
(truncate_setsize+0x5c/0x74)
[   21.447731] [<c00c0fec>] (truncate_setsize) from [<c013b3a8>]
(put_aio_ring_file.isra.14+0x34/0x90)
[   21.456826] [<c013b3a8>] (put_aio_ring_file.isra.14) from
[<c013b424>] (aio_free_ring+0x20/0xcc)
[   21.465660] [<c013b424>] (aio_free_ring) from [<c013b4f4>]
(free_ioctx+0x24/0x44)
[   21.473190] [<c013b4f4>] (free_ioctx) from [<c003d8d8>]
(process_one_work+0x134/0x47c)
[   21.481132] [<c003d8d8>] (process_one_work) from [<c003e988>]
(worker_thread+0x130/0x414)
[   21.489350] [<c003e988>] (worker_thread) from [<c00448ac>]
(kthread+0xd4/0xec)
[   21.496621] [<c00448ac>] (kthread) from [<c000ec18>]
(ret_from_fork+0x14/0x20)
[   21.503884] ---[ end trace 79c4bf42c038c9a1 ]---

The cause is that we set the aio ring file pages as *DIRTY* via SetPageDirty
(bypasses the VFS dirty pages increment) when init, and aio fs uses
*default_backing_dev_info* as the backing dev, which does not disable
the dirty pages accounting capability.
So truncating aio ring file will contribute to accounting dirty pages (VFS
dirty pages decrement), then error occurs.

The original goal is keeping these pages in memory (can not be reclaimed
or swapped) in life-time via marking it dirty. But thinking more, we have
already pinned pages via elevating the page's refcount, which can already
achieve the goal, so the SetPageDirty seems unnecessary.

In order to fix the issue, using the __set_page_dirty_no_writeback instead
of the nop .set_page_dirty, and dropped the SetPageDirty (don't manually
set the dirty flags, don't disable set_page_dirty(), rely on default behaviour).

With the above change, the dirty pages accounting can work well. But as we
known, aio fs is an anonymous one, which should never cause any real write-back,
we can ignore the dirty pages (write back) accounting by disabling the dirty
pages (write back) accounting capability. So we introduce an aio private
backing dev info (disabled the ACCT_DIRTY/WRITEBACK/ACCT_WB capabilities) to
replace the default one.

Reported-by: Markus Königshaus <[email protected]>
Signed-off-by: Gu Zheng <[email protected]>
Cc: stable <[email protected]>
---
v2:
 -explain more and add necessary code comment as akpm suggested.
---
 fs/aio.c |   21 ++++++++++++++-------
 1 files changed, 14 insertions(+), 7 deletions(-)
alexandrebelloni pushed a commit to alexandrebelloni/linux that referenced this pull request Nov 10, 2014
@bcrl
aio: fix uncorrent dirty pages accouting when truncating AIO ring buffer
835f252 
https://bugzilla.kernel.org/show_bug.cgi?id=86831

Markus reported that when shutting down mysqld (with AIO support,
on a ext3 formatted Harddrive) leads to a negative number of dirty pages
(underrun to the counter). The negative number results in a drastic reduction
of the write performance because the page cache is not used, because the kernel
thinks it is still 2 ^ 32 dirty pages open.

Add a warn trace in __dec_zone_state will catch this easily:

static inline void __dec_zone_state(struct zone *zone, enum
	zone_stat_item item)
{
     atomic_long_dec(&zone->vm_stat[item]);
+    WARN_ON_ONCE(item == NR_FILE_DIRTY &&
	atomic_long_read(&zone->vm_stat[item]) < 0);
     atomic_long_dec(&vm_stat[item]);
}

[   21.341632] ------------[ cut here ]------------
[   21.346294] WARNING: CPU: 0 PID: 309 at include/linux/vmstat.h:242
cancel_dirty_page+0x164/0x224()
[   21.355296] Modules linked in: wutbox_cp sata_mv
[   21.359968] CPU: 0 PID: 309 Comm: kworker/0:1 Not tainted 3.14.21-WuT torvalds#80
[   21.366793] Workqueue: events free_ioctx
[   21.370760] [<c0016a64>] (unwind_backtrace) from [<c0012f88>]
(show_stack+0x20/0x24)
[   21.378562] [<c0012f88>] (show_stack) from [<c03f8ccc>]
(dump_stack+0x24/0x28)
[   21.385840] [<c03f8ccc>] (dump_stack) from [<c0023ae4>]
(warn_slowpath_common+0x84/0x9c)
[   21.393976] [<c0023ae4>] (warn_slowpath_common) from [<c0023bb8>]
(warn_slowpath_null+0x2c/0x34)
[   21.402800] [<c0023bb8>] (warn_slowpath_null) from [<c00c0688>]
(cancel_dirty_page+0x164/0x224)
[   21.411524] [<c00c0688>] (cancel_dirty_page) from [<c00c080c>]
(truncate_inode_page+0x8c/0x158)
[   21.420272] [<c00c080c>] (truncate_inode_page) from [<c00c0a94>]
(truncate_inode_pages_range+0x11c/0x53c)
[   21.429890] [<c00c0a94>] (truncate_inode_pages_range) from
[<c00c0f6c>] (truncate_pagecache+0x88/0xac)
[   21.439252] [<c00c0f6c>] (truncate_pagecache) from [<c00c0fec>]
(truncate_setsize+0x5c/0x74)
[   21.447731] [<c00c0fec>] (truncate_setsize) from [<c013b3a8>]
(put_aio_ring_file.isra.14+0x34/0x90)
[   21.456826] [<c013b3a8>] (put_aio_ring_file.isra.14) from
[<c013b424>] (aio_free_ring+0x20/0xcc)
[   21.465660] [<c013b424>] (aio_free_ring) from [<c013b4f4>]
(free_ioctx+0x24/0x44)
[   21.473190] [<c013b4f4>] (free_ioctx) from [<c003d8d8>]
(process_one_work+0x134/0x47c)
[   21.481132] [<c003d8d8>] (process_one_work) from [<c003e988>]
(worker_thread+0x130/0x414)
[   21.489350] [<c003e988>] (worker_thread) from [<c00448ac>]
(kthread+0xd4/0xec)
[   21.496621] [<c00448ac>] (kthread) from [<c000ec18>]
(ret_from_fork+0x14/0x20)
[   21.503884] ---[ end trace 79c4bf42c038c9a1 ]---

The cause is that we set the aio ring file pages as *DIRTY* via SetPageDirty
(bypasses the VFS dirty pages increment) when init, and aio fs uses
*default_backing_dev_info* as the backing dev, which does not disable
the dirty pages accounting capability.
So truncating aio ring file will contribute to accounting dirty pages (VFS
dirty pages decrement), then error occurs.

The original goal is keeping these pages in memory (can not be reclaimed
or swapped) in life-time via marking it dirty. But thinking more, we have
already pinned pages via elevating the page's refcount, which can already
achieve the goal, so the SetPageDirty seems unnecessary.

In order to fix the issue, using the __set_page_dirty_no_writeback instead
of the nop .set_page_dirty, and dropped the SetPageDirty (don't manually
set the dirty flags, don't disable set_page_dirty(), rely on default behaviour).

With the above change, the dirty pages accounting can work well. But as we
known, aio fs is an anonymous one, which should never cause any real write-back,
we can ignore the dirty pages (write back) accounting by disabling the dirty
pages (write back) accounting capability. So we introduce an aio private
backing dev info (disabled the ACCT_DIRTY/WRITEBACK/ACCT_WB capabilities) to
replace the default one.

Reported-by: Markus Königshaus <[email protected]>
Signed-off-by: Gu Zheng <[email protected]>
Cc: stable <[email protected]>
Acked-by: Andrew Morton <[email protected]>
Signed-off-by: Benjamin LaHaise <[email protected]>
aryabinin referenced this pull request in aryabinin/linux Nov 18, 2014
@hnaz
linux-next
dc65df9 
GIT ca1fa22e67bcfc84f49e44ad6f728e3e3d487dce

commit 48eb5b9c3dd2768b6a4de9c1eab606820fd84192
Author: Daniel Borkmann <[email protected]>
Date:   Tue Nov 11 10:22:05 2014 -0800

    ixgbe: phy: fix uninitialized status in ixgbe_setup_phy_link_tnx
    
    Status variable is never initialized, can carry an arbitrary value
    on the stack and thus may let the function fail.
    
    Fixes: e90dd2645664 ("ixgbe: Make return values more direct")
    Signed-off-by: Daniel Borkmann <[email protected]>
    Acked-by: Emil Tantilov <[email protected]>
    Signed-off-by: Jeff Kirsher <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 4eed83a252257ad8ad41ba1c769341960ed4cdc5
Author: James Cameron <[email protected]>
Date:   Tue Nov 11 16:21:28 2014 +1100

    mwifiex: simplify ad hoc join capability info
    
    While preparing an ad-hoc start command, the capability info bitmap is
    needlessly set from the command, and then the ESS bit cleared.
    
    Change to set the bitmap directly without reference to the command.
    
    Signed-off-by: James Cameron <[email protected]>
    Acked-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit d351f5fea44a7527819598070e11b5c9dc53c017
Author: Luciano Coelho <[email protected]>
Date:   Mon Nov 10 09:25:57 2014 +0200

    wlcore: make wlcore_cmd_send_failsafe() static
    
    The wlcore_cmd_send_failsafe() function is only called in the cmd.c
    file, where it is definde.  Make it static.
    
    Additionally, move the EXPORT_SYMBOL macro for wl1271_cmd_send() to
    the right place.
    
    Signed-off-by: Luciano Coelho <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit f5b8f4790bb5dfd541f9d61589357ea6042cc668
Author: Luciano Coelho <[email protected]>
Date:   Mon Nov 10 09:25:17 2014 +0200

    wlcore: check minimum buffer size in some cmd_send functions
    
    Check for the minimum required buffer length in wlcore_cmd_send() and
    wlcore_cmd_configure_failsafe.  This ensures that we will never try to
    use a buffer that is smaller than the required header.
    
    Reported-by: Dan Carpenter <[email protected]>
    Signed-off-by: Luciano Coelho <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 0d4b5c7c0892cb377cc71c388433425f598b902b
Author: Amitkumar Karwar <[email protected]>
Date:   Fri Nov 7 02:14:52 2014 -0800

    mwifiex: fix version display problem on big endian platforms
    
    It's been observed that wrong firmware version (ex. 66.14.96.p9
    instead of 14.66.9.p96) is displayed on big endian platforms.
    
    The problem is fixed here.
    
    Reported-by: Daniel Mosquera <[email protected]>
    Tested-by: Daniel Mosquera <[email protected]>
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 3f2aa13f6d16a53a4cf5de369c685c6f75fe4d58
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:38 2014 +0100

    ath9k_htc: add spectral scan debug interface
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 83fb287ecd8ae60ed79c647a5df8beacdf4f4807
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:37 2014 +0100

    ath9k_htc: process rx spectral packets
    
    use code provided by Ashish Patro <[email protected]>
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 911544f6a8d66c27ff807f5d71e3f0f5a904c100
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:36 2014 +0100

    ath9k_htc: trigger spectral scan on set_channel
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 88a2e3fb7b7e9dd3c51ceef81e0415478c27910c
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:35 2014 +0100

    ath9k_htc: set initial spec_config values
    
    use values provided by Ashish Patro <[email protected]>
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit fe30e8bb5be52e2e6b913db77dda6c22b643dbd7
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:34 2014 +0100

    ath9k_htc: add struct ath_spec_scan_priv to ath9k_htc_priv
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 94cd95c217a5ed4c45e2a8c97043c3efcd66dac9
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:33 2014 +0100

    ath9k_htc: add ath_ps_ops bindings
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 525d09456b9fc2f769647c744c75629d9926fb9e
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:32 2014 +0100

    ath9k_htc: fix rs_datalen conversation
    
    For some reason it didn't coused obvious problems.
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 46140ddf169703ef0538bf00098233b24b2269e8
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:31 2014 +0100

    ath9k: For AR9271 chipsets, set count = 0 for endless samples.
    
    not sure why.
    Initially provided by Ashish Patro <[email protected]>
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 67dc74f15f147b9f88702de2952d2951e3e000ec
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:30 2014 +0100

    ath9k: move spectral.* to common-spectral.*
    
    and rename exports from ath9k_spectral_* to ath9k_cmn_spectral_*
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit f00a422cc81ef665f5098c0bc43cb0c616e55a9b
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:29 2014 +0100

    ath9k: move ath9k_spectral_scan_ from main.c to spectral.c
    
    Now we should be ready to make this code common.
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 963916dfe2907d91eb8a250d12d2b5ae5a1bb343
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:28 2014 +0100

    ath9k: make ath9k_spectral_scan_ do not depend on ath_softc
    
    last preparation before moving ath9k_spectral_scan_ to spectral.c
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit ef948da55f20edbb68dac427b7e067c805c852f5
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:27 2014 +0100

    ath9k: use ath_common instead of ieee80211_hw in ath9k_spectral_scan_
    
    we don't have here any ieee80211_hw dependencies any way.
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 934bdc73dd3029c1b91e1a3538268b4afccd58cf
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:26 2014 +0100

    ath9k: use ath_ps_ops in ath9k_spectral_scan_
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 99d2217b731e664aa31001839f12944b1e114a08
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:25 2014 +0100

    ath9k: add ath_ps_ops bindings
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 0198c2e2987c5cd4980f15126d7c68759f4def95
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:24 2014 +0100

    ath: add struct ath_ps_ops
    
    we will need it to make common code
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 1111d426ef6a62903a8427a80c2a20cdf0380349
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:23 2014 +0100

    ath9k: remove all struct ath_softc dependencies from spectral code
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit dd7657be756551b23b3431d81e66a8d95a72c923
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:22 2014 +0100

    ath9k: add ath_hw to ath_spec_scan_priv
    
    spectral code mostly depends on ath_hw, not on ath_softc
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit c10b75af4344fe0e678d167cb401a94f565e978c
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:21 2014 +0100

    ath9k: use struct dentry by ath9k_spectral_init_debug
    
    this will alow us to make ath_softc independent code.
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 21af25d00b8bdf03a899b316d41d31ac3eafaf78
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:20 2014 +0100

    ath9k: move spec_config to ath_spec_scan_priv
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 8391f60194bd0d9ab489105381df6455afe1f39a
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:19 2014 +0100

    ath9k: move spectral_mode to ath_spec_scan_priv
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 911ea79f435302fabefa305d3649efd4e205672b
Author: Oleksij Rempel <[email protected]>
Date:   Thu Nov 6 08:53:18 2014 +0100

    ath9k: add struct ath_spec_scan_priv
    
    and move rfs_chan_spec_scan to this struct. We will need it
    for common spectral scan code.
    
    Signed-off-by: Oleksij Rempel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit d7d8b83473e6932cfe9f89e6d839f27abf35b319
Author: Avinash Patil <[email protected]>
Date:   Wed Nov 5 17:04:31 2014 +0530

    mwifiex: fix warning while starting BSS
    
    We see this warning while starting mwifiex AP:
    Unsupported RX-STBC, default to 2x2
    
    This was happening because of wrong offset while copying HT
    capabilities from BSS configuration of start_ap handler.
    
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: Avinash Patil <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit bfd713bc1a5d7f01e3d7febe0849b21ae1355c7c
Author: Avinash Patil <[email protected]>
Date:   Wed Nov 5 17:04:30 2014 +0530

    mwifiex: do not setup AMPDU/AMSDU with broadcast receiver
    
    It is observed that device sometimes sends BA setup requests for
    broadcast mac address.
    This patch adds a check to avoid checking availability of
    AMPDU/AMSDU streams for broadcast mac address.
    
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: Avinash Patil <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit cf6a64fd603ae0f7391f7589b0f3568d4e79605c
Author: Amitkumar Karwar <[email protected]>
Date:   Wed Nov 5 17:04:29 2014 +0530

    mwifiex: fix out of memory issue observed for USB chipsets
    
    On some platforms, system goes out of memory during heavy
    Rx traffic with our USB chipsets.
    
    In case of SDIO/PCIe, after receiving 50 packets in Rx queue
    we stop processing interrupts till packets pending fall below
    low threshold i.e 20. We don't have similar logic for USB,
    so if host platform is slow, we would hit a case where firmware
    keeps on pushing packets at high speed than driver/kernel can
    process.
    
    We will stop submitting URBs for Rx data when pending packet
    count reaches high threshold and restart them when enough
    packets are consumed to solve the problem.
    
    BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=85071
    Reported-by: Marek Belisko <[email protected]>
    Tested-by: Marek Belisko <[email protected]>
    Signed-off-by: Avinash Patil <[email protected]>
    Signed-off-by: Cathy Luo <[email protected]>
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 041bfab5bbb6ec721c743f487e3e22b87f666996
Author: Avinash Patil <[email protected]>
Date:   Wed Nov 5 17:04:28 2014 +0530

    mwifiex: remove data_complete handler
    
    This patch removes redundant data complete handler.
    
    Signed-off-by: Avinash Patil <[email protected]>
    Signed-off-by: Cathy Luo <[email protected]>
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit ec4a16b4d287d4d0f7465ae7e61ce4e9021d715c
Author: Avinash Patil <[email protected]>
Date:   Wed Nov 5 17:04:27 2014 +0530

    mwifiex: rx workqueue support for USB interface
    
    This patch adds RX workqueue support for USB interfaces.
    Currently rx_pending is applicable for cmd/events and Rx
    data in USB interface. Let's use it only for Rx data.
    
    Signed-off-by: Avinash Patil <[email protected]>
    Signed-off-by: Cathy Luo <[email protected]>
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit d385c5c2860075e1f3e03074f043dd8a828b2862
Author: Felix Fietkau <[email protected]>
Date:   Tue Nov 4 16:56:57 2014 +0100

    ath9k: add support for reporting tx power to mac80211
    
    Track it per channel context instead of in the softc
    
    Signed-off-by: Felix Fietkau <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 71783576b5345d63df048c0f18974037eea6e4f9
Author: Hauke Mehrtens <[email protected]>
Date:   Sat Nov 1 16:54:56 2014 +0100

    bcma: get IRQ numbers from dt
    
    It is not possible to auto detect the irq numbers used by the cores on
    an arm SoC. If bcma was registered with device tree it will search for
    some device tree nodes with the irq number and add it to the core
    configuration.
    
    Signed-off-by: Hauke Mehrtens <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 85eb92e81801d64686eb78928d500a4c83ee9623
Author: Hauke Mehrtens <[email protected]>
Date:   Sat Nov 1 16:54:55 2014 +0100

    bcma: make it possible to specify a IRQ num in bcma_core_irq()
    
    This moves bcma_core_irq() to main.c and add a extra parameter with a
    number so that we can return different irq number for devices with more
    than one.
    
    Signed-off-by: Hauke Mehrtens <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 09626e9d153326ca82568e4e27f2daa53713992e
Author: WANG Cong <[email protected]>
Date:   Tue Nov 11 13:29:42 2014 -0800

    net: kill netif_copy_real_num_queues()
    
    vlan was the only user of netif_copy_real_num_queues(),
    but it no longer calls it after
    commit 4af429d29b341bb1735f04c2fb960178 ("vlan: lockless transmit path").
    So we can just remove it.
    
    Cc: Eric Dumazet <[email protected]>
    Cc: David S. Miller <[email protected]>
    Signed-off-by: Cong Wang <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 67732cd34382066ae5df313b6dad65ab14b9735f
Author: Ulf Hansson <[email protected]>
Date:   Tue Nov 11 11:07:08 2014 +0100

    PM / Domains: Fix initial default state of the need_restore flag
    
    The initial state of the device's need_restore flag should'nt depend on
    the current state of the PM domain. For example it should be perfectly
    valid to attach an inactive device to a powered PM domain.
    
    The pm_genpd_dev_need_restore() API allow us to update the need_restore
    flag to somewhat cope with such scenarios. Typically that should have
    been done from drivers/buses ->probe() since it's those that put the
    requirements on the value of the need_restore flag.
    
    Until recently, the Exynos SOCs were the only user of the
    pm_genpd_dev_need_restore() API, though invoking it from a centralized
    location while adding devices to their PM domains.
    
    Due to that Exynos now have swithed to the generic OF-based PM domain
    look-up, it's no longer possible to invoke the API from a centralized
    location. The reason is because devices are now added to their PM
    domains during the probe sequence.
    
    Commit "ARM: exynos: Move to generic PM domain DT bindings"
    did the switch for Exynos to the generic OF-based PM domain look-up,
    but it also removed the call to pm_genpd_dev_need_restore(). This
    caused a regression for some of the Exynos drivers.
    
    To handle things more properly in the generic PM domain, let's change
    the default initial value of the need_restore flag to reflect that the
    state is unknown. As soon as some of the runtime PM callbacks gets
    invoked, update the initial value accordingly.
    
    Moreover, since the generic PM domain is verifying that all devices
    are both runtime PM enabled and suspended, using pm_runtime_suspended()
    while pm_genpd_poweroff() is invoked from the scheduled work, we can be
    sure of that the PM domain won't be powering off while having active
    devices.
    
    Do note that, the generic PM domain can still only know about active
    devices which has been activated through invoking its runtime PM resume
    callback. In other words, buses/drivers using pm_runtime_set_active()
    during ->probe() will still suffer from a race condition, potentially
    probing a device without having its PM domain being powered. That issue
    will have to be solved using a different approach.
    
    This a log from the boot regression for Exynos5, which is being fixed in
    this patch.
    
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 308 at ../drivers/clk/clk.c:851 clk_disable+0x24/0x30()
    Modules linked in:
    CPU: 0 PID: 308 Comm: kworker/0:1 Not tainted 3.18.0-rc3-00569-gbd9449f-dirty #10
    Workqueue: pm pm_runtime_work
    [<c0013c64>] (unwind_backtrace) from [<c0010dec>] (show_stack+0x10/0x14)
    [<c0010dec>] (show_stack) from [<c03ee4cc>] (dump_stack+0x70/0xbc)
    [<c03ee4cc>] (dump_stack) from [<c0020d34>] (warn_slowpath_common+0x64/0x88)
    [<c0020d34>] (warn_slowpath_common) from [<c0020d74>] (warn_slowpath_null+0x1c/0x24)
    [<c0020d74>] (warn_slowpath_null) from [<c03107b0>] (clk_disable+0x24/0x30)
    [<c03107b0>] (clk_disable) from [<c02cc834>] (gsc_runtime_suspend+0x128/0x160)
    [<c02cc834>] (gsc_runtime_suspend) from [<c0249024>] (pm_generic_runtime_suspend+0x2c/0x38)
    [<c0249024>] (pm_generic_runtime_suspend) from [<c024f44c>] (pm_genpd_default_save_state+0x2c/0x8c)
    [<c024f44c>] (pm_genpd_default_save_state) from [<c024ff2c>] (pm_genpd_poweroff+0x224/0x3ec)
    [<c024ff2c>] (pm_genpd_poweroff) from [<c02501b4>] (pm_genpd_runtime_suspend+0x9c/0xcc)
    [<c02501b4>] (pm_genpd_runtime_suspend) from [<c024a4f8>] (__rpm_callback+0x2c/0x60)
    [<c024a4f8>] (__rpm_callback) from [<c024a54c>] (rpm_callback+0x20/0x74)
    [<c024a54c>] (rpm_callback) from [<c024a930>] (rpm_suspend+0xd4/0x43c)
    [<c024a930>] (rpm_suspend) from [<c024bbcc>] (pm_runtime_work+0x80/0x90)
    [<c024bbcc>] (pm_runtime_work) from [<c0032a9c>] (process_one_work+0x12c/0x314)
    [<c0032a9c>] (process_one_work) from [<c0032cf4>] (worker_thread+0x3c/0x4b0)
    [<c0032cf4>] (worker_thread) from [<c003747c>] (kthread+0xcc/0xe8)
    [<c003747c>] (kthread) from [<c000e738>] (ret_from_fork+0x14/0x3c)
    ---[ end trace 40cd58bcd6988f12 ]---
    
    Fixes: a4a8c2c4962bb655 (ARM: exynos: Move to generic PM domain DT bindings)
    Reported-and-tested0by: Sylwester Nawrocki <[email protected]>
    Reviewed-by: Sylwester Nawrocki <[email protected]>
    Reviewed-by: Kevin Hilman <[email protected]>
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Rafael J. Wysocki <[email protected]>

commit 4e6ce4dc7ce71d0886908d55129d5d6482a27ff9
Author: Miaoqing Pan <[email protected]>
Date:   Thu Nov 6 10:52:23 2014 +0530

    ath9k: Fix RTC_DERIVED_CLK usage
    
    Based on the reference clock, which could be 25MHz or 40MHz,
    AR_RTC_DERIVED_CLK is programmed differently for AR9340 and AR9550.
    But, when a chip reset is done, processing the initvals
    sets the register back to the default value.
    
    Fix this by moving the code in ath9k_hw_init_pll() to
    ar9003_hw_override_ini(). Also, do this override for AR9531.
    
    Cc: [email protected]
    Signed-off-by: Miaoqing Pan <[email protected]>
    Signed-off-by: Sujith Manoharan <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 8bca81d9875c7768c40a19fb439eebaf6cec898d
Author: Sudip Mukherjee <[email protected]>
Date:   Tue Nov 11 14:10:47 2014 +0530

    usbnet: smsc95xx: dereferencing NULL pointer
    
    we were dereferencing dev to initialize pdata. but just after that we
    have a BUG_ON(!dev). so we were basically dereferencing the pointer
    first and then tesing it for NULL.
    
    Signed-off-by: Sudip Mukherjee <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit d65c4e4e0aeb699e984bd4b382efffab418aa359
Author: Joe Perches <[email protected]>
Date:   Tue Nov 11 13:13:41 2014 -0800

    irda: Simplify IRDA logging macros
    
    These are the same as net_<level>_ratelimited, so
    use the more common style in the macro definition.
    
    Signed-off-by: Joe Perches <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 79ce0477ffe82e7e49e55179cd176a1c33382744
Author: Brian Hill <[email protected]>
Date:   Tue Nov 11 13:39:39 2014 -0700

    net: phy: Correctly handle MII ioctl which changes autonegotiation.
    
    When advertised capabilities are changed with mii-tool, such as:
    mii-tool -A 10baseT
    the existing handler has two errors.
    
    - An actual PHY register value is provided by mii-tool, and this
      must be mapped to internal state with mii_adv_to_ethtool_adv_t().
    - The PHY state machine needs to be told that autonegotiation has
      again been performed.  If not, the MAC will not be notified of
      the new link speed and duplex, resulting in a possible config
      mismatch.
    
    Signed-off-by: Brian Hill <[email protected]>
    Acked-by: Florian Fainelli <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 0cd75b19899fd86b51a6480fb8c00dcd85a54591
Author: Arend van Spriel <[email protected]>
Date:   Tue Nov 11 13:58:44 2014 +0100

    brcmfmac: fix conversion of channel width 20MHZ_NOHT
    
    The function chandef_to_chanspec() failed when converting a
    chandef with bandwidth set to NL80211_CHAN_WIDTH_20_NOHT. This
    was reported by user running the device in AP mode.
    
    ------------[ cut here ]------------
    WARNING: CPU: 0 PID: 304 at
    	drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c:381
    		chandef_to_chanspec.isra.11+0x158/0x184()
    
    Modules linked in:
    
    CPU: 0 PID: 304 Comm: hostapd Not tainted 3.16.0-rc7-abb+g64aa90f #8
    
    [<c0014bb4>] (unwind_backtrace) from [<c0012314>] (show_stack+0x10/0x14)
    [<c0012314>] (show_stack) from [<c001d3f8>] (warn_slowpath_common+0x6c/0x8c)
    [<c001d3f8>] (warn_slowpath_common) from [<c001d4b4>] (warn_slowpath_null+0x1c/0x24)
    [<c001d4b4>] (warn_slowpath_null) from [<c03449a4>] (chandef_to_chanspec.isra.11+0x158/0x184)
    [<c03449a4>] (chandef_to_chanspec.isra.11) from [<c0348e00>] (brcmf_cfg80211_start_ap+0x1e4/0x614)
    [<c0348e00>] (brcmf_cfg80211_start_ap) from [<c04d1468>] (nl80211_start_ap+0x288/0x414)
    [<c04d1468>] (nl80211_start_ap) from [<c043d144>] (genl_rcv_msg+0x21c/0x38c)
    [<c043d144>] (genl_rcv_msg) from [<c043c740>] (netlink_rcv_skb+0xac/0xc0)
    [<c043c740>] (netlink_rcv_skb) from [<c043cf14>] (genl_rcv+0x20/0x34)
    [<c043cf14>] (genl_rcv) from [<c043c0a0>] (netlink_unicast+0x150/0x20c)
    [<c043c0a0>] (netlink_unicast) from [<c043c4b8>] (netlink_sendmsg+0x2b8/0x398)
    [<c043c4b8>] (netlink_sendmsg) from [<c04066a4>] (sock_sendmsg+0x84/0xa8)
    [<c04066a4>] (sock_sendmsg) from [<c0407c5c>] (___sys_sendmsg.part.29+0x268/0x278)
    [<c0407c5c>] (___sys_sendmsg.part.29) from [<c0408bdc>] (__sys_sendmsg+0x4c/0x7c)
    [<c0408bdc>] (__sys_sendmsg) from [<c000ec60>] (ret_fast_syscall+0x0/0x44)
    ---[ end trace 965ee2158c9905a2 ]---
    
    Cc: [email protected] # v3.17
    Reported-by: Pontus Fuchs <[email protected]>
    Reviewed-by: Hante Meuleman <[email protected]>
    Reviewed-by: Daniel (Deognyoun) Kim <[email protected]>
    Reviewed-by: Franky (Zhenhui) Lin <[email protected]>
    Reviewed-by: Pieter-Paul Giesberts <[email protected]>
    Signed-off-by: Arend van Spriel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit cfd9167af14eb4ec21517a32911d460083ee3d59
Author: Stanislaw Gruszka <[email protected]>
Date:   Tue Nov 11 14:28:47 2014 +0100

    rt2x00: do not align payload on modern H/W
    
    RT2800 and newer hardware require padding between header and payload if
    header length is not multiple of 4.
    
    For historical reasons we also align payload to to 4 bytes boundary, but
    such alignment is not needed on modern H/W.
    
    Patch fixes skb_under_panic problems reported from time to time:
    
    https://bugzilla.kernel.org/show_bug.cgi?id=84911
    https://bugzilla.kernel.org/show_bug.cgi?id=72471
    http://marc.info/?l=linux-wireless&m=139108549530402&w=2
    https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1087591
    
    Panic happened because we eat 4 bytes of skb headroom on each
    (re)transmission when sending frame without the payload and the header
    length not being multiple of 4 (i.e. QoS header has 26 bytes). On such
    case because paylad_aling=2 is bigger than header_align=0 we increase
    header_align by 4 bytes. To prevent that we could change the check to:
    
    	if (payload_length && payload_align > header_align)
    		header_align += 4;
    
    but not aligning payload at all is more effective and alignment is not
    really needed by H/W (that has been tested on OpenWrt project for few
    years now).
    
    Reported-and-tested-by: Antti S. Lankila <[email protected]>
    Debugged-by: Antti S. Lankila <[email protected]>
    Reported-by: Henrik Asp <[email protected]>
    Originally-From: Helmut Schaa <[email protected]>
    Cc: [email protected]
    Signed-off-by: Stanislaw Gruszka <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit f47436734dc89ece62654d4db8d08163a89dd7ca
Author: Joe Perches <[email protected]>
Date:   Fri Oct 31 10:50:46 2014 -0700

    tile: Use the more common pr_warn instead of pr_warning
    
    And other message logging neatening.
    
    Other miscellanea:
    
    o coalesce formats
    o realign arguments
    o standardize a couple of macros
    o use __func__ instead of embedding the function name
    
    Signed-off-by: Joe Perches <[email protected]>
    Signed-off-by: Chris Metcalf <[email protected]>

commit ebd25caf7d511312d1a9724ab5752e9e661dfe60
Author: Chen Gang <[email protected]>
Date:   Sun Nov 9 18:32:03 2014 +0800

    arch: tile: gxio: Export symbols for module using in 'mpipe.c'
    
    'gxio_mpipe_adjust_timestamp', 'gxio_mpipe_link_instance',
    'gxio_mpipe_get_timestamp', and 'gxio_mpipe_set_timestamp' may be use by
    other tile modules, so export them.
    
    The related error (with allmodconfig under tile):
    
        MODPOST 4002 modules
      ERROR: "gxio_mpipe_link_instance" [drivers/net/ethernet/tile/tile_net.ko] undefined!
      ERROR: "gxio_mpipe_get_timestamp" [drivers/net/ethernet/tile/tile_net.ko] undefined!
      ERROR: "gxio_mpipe_set_timestamp" [drivers/net/ethernet/tile/tile_net.ko] undefined!
      ERROR: "gxio_mpipe_adjust_timestamp" [drivers/net/ethernet/tile/tile_net.ko] undefined!
    
    Signed-off-by: Chen Gang <[email protected]>
    Signed-off-by: Chris Metcalf <[email protected]>

commit 5337b5b75cd9bd3624a6820e3c2a084d2480061c
Author: Eric Dumazet <[email protected]>
Date:   Mon Nov 10 17:54:25 2014 -0800

    ipv6: fix IPV6_PKTINFO with v4 mapped
    
    Use IS_ENABLED(CONFIG_IPV6), to enable this code if IPv6 is
    a module.
    
    Signed-off-by: Eric Dumazet <[email protected]>
    Fixes: c8e6ad0829a7 ("ipv6: honor IPV6_PKTINFO with v4 mapped addresses on sendmsg")
    Acked-by: Hannes Frederic Sowa <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit d7480fd3b1738a8eae6a76098b17af318cf9b9cc
Author: WANG Cong <[email protected]>
Date:   Mon Nov 10 15:59:36 2014 -0800

    neigh: remove dynamic neigh table registration support
    
    Currently there are only three neigh tables in the whole kernel:
    arp table, ndisc table and decnet neigh table. What's more,
    we don't support registering multiple tables per family.
    Therefore we can just make these tables statically built-in.
    
    Cc: David S. Miller <[email protected]>
    Signed-off-by: Cong Wang <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 4184b2a79a7612a9272ce20d639934584a1f3786
Author: Daniel Borkmann <[email protected]>
Date:   Mon Nov 10 18:00:09 2014 +0100

    net: sctp: fix memory leak in auth key management
    
    A very minimal and simple user space application allocating an SCTP
    socket, setting SCTP_AUTH_KEY setsockopt(2) on it and then closing
    the socket again will leak the memory containing the authentication
    key from user space:
    
    unreferenced object 0xffff8800837047c0 (size 16):
      comm "a.out", pid 2789, jiffies 4296954322 (age 192.258s)
      hex dump (first 16 bytes):
        01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00  ................
      backtrace:
        [<ffffffff816d7e8e>] kmemleak_alloc+0x4e/0xb0
        [<ffffffff811c88d8>] __kmalloc+0xe8/0x270
        [<ffffffffa0870c23>] sctp_auth_create_key+0x23/0x50 [sctp]
        [<ffffffffa08718b1>] sctp_auth_set_key+0xa1/0x140 [sctp]
        [<ffffffffa086b383>] sctp_setsockopt+0xd03/0x1180 [sctp]
        [<ffffffff815bfd94>] sock_common_setsockopt+0x14/0x20
        [<ffffffff815beb61>] SyS_setsockopt+0x71/0xd0
        [<ffffffff816e58a9>] system_call_fastpath+0x12/0x17
        [<ffffffffffffffff>] 0xffffffffffffffff
    
    This is bad because of two things, we can bring down a machine from
    user space when auth_enable=1, but also we would leave security sensitive
    keying material in memory without clearing it after use. The issue is
    that sctp_auth_create_key() already sets the refcount to 1, but after
    allocation sctp_auth_set_key() does an additional refcount on it, and
    thus leaving it around when we free the socket.
    
    Fixes: 65b07e5d0d0 ("[SCTP]: API updates to suport SCTP-AUTH extensions.")
    Signed-off-by: Daniel Borkmann <[email protected]>
    Cc: Vlad Yasevich <[email protected]>
    Acked-by: Neil Horman <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit e40607cbe270a9e8360907cb1e62ddf0736e4864
Author: Daniel Borkmann <[email protected]>
Date:   Mon Nov 10 17:54:26 2014 +0100

    net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet
    
    An SCTP server doing ASCONF will panic on malformed INIT ping-of-death
    in the form of:
    
      ------------ INIT[PARAM: SET_PRIMARY_IP] ------------>
    
    While the INIT chunk parameter verification dissects through many things
    in order to detect malformed input, it misses to actually check parameters
    inside of parameters. E.g. RFC5061, section 4.2.4 proposes a 'set primary
    IP address' parameter in ASCONF, which has as a subparameter an address
    parameter.
    
    So an attacker may send a parameter type other than SCTP_PARAM_IPV4_ADDRESS
    or SCTP_PARAM_IPV6_ADDRESS, param_type2af() will subsequently return 0
    and thus sctp_get_af_specific() returns NULL, too, which we then happily
    dereference unconditionally through af->from_addr_param().
    
    The trace for the log:
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000078
    IP: [<ffffffffa01e9c62>] sctp_process_init+0x492/0x990 [sctp]
    PGD 0
    Oops: 0000 [#1] SMP
    [...]
    Pid: 0, comm: swapper Not tainted 2.6.32-504.el6.x86_64 #1 Bochs Bochs
    RIP: 0010:[<ffffffffa01e9c62>]  [<ffffffffa01e9c62>] sctp_process_init+0x492/0x990 [sctp]
    [...]
    Call Trace:
     <IRQ>
     [<ffffffffa01f2add>] ? sctp_bind_addr_copy+0x5d/0xe0 [sctp]
     [<ffffffffa01e1fcb>] sctp_sf_do_5_1B_init+0x21b/0x340 [sctp]
     [<ffffffffa01e3751>] sctp_do_sm+0x71/0x1210 [sctp]
     [<ffffffffa01e5c09>] ? sctp_endpoint_lookup_assoc+0xc9/0xf0 [sctp]
     [<ffffffffa01e61f6>] sctp_endpoint_bh_rcv+0x116/0x230 [sctp]
     [<ffffffffa01ee986>] sctp_inq_push+0x56/0x80 [sctp]
     [<ffffffffa01fcc42>] sctp_rcv+0x982/0xa10 [sctp]
     [<ffffffffa01d5123>] ? ipt_local_in_hook+0x23/0x28 [iptable_filter]
     [<ffffffff8148bdc9>] ? nf_iterate+0x69/0xb0
     [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0
     [<ffffffff8148bf86>] ? nf_hook_slow+0x76/0x120
     [<ffffffff81496d10>] ? ip_local_deliver_finish+0x0/0x2d0
    [...]
    
    A minimal way to address this is to check for NULL as we do on all
    other such occasions where we know sctp_get_af_specific() could
    possibly return with NULL.
    
    Fixes: d6de3097592b ("[SCTP]: Add the handling of "Set Primary IP Address" parameter to INIT")
    Signed-off-by: Daniel Borkmann <[email protected]>
    Cc: Vlad Yasevich <[email protected]>
    Acked-by: Neil Horman <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 5748eb8f8e989a9da1ac7c96dc73d68cbdedf7df
Author: Takashi Iwai <[email protected]>
Date:   Mon Nov 10 11:50:21 2014 +0100

    net: ppp: Don't call bpf_prog_create() in ppp_lock
    
    In ppp_ioctl(), bpf_prog_create() is called inside ppp_lock, which
    eventually calls vmalloc() and hits BUG_ON() in vmalloc.c.  This patch
    works around the problem by moving the allocation outside the lock.
    
    The bug was revealed by the recent change in net/core/filter.c, as it
    allocates via vmalloc() instead of kmalloc() now.
    
    Reported-and-tested-by: Stefan Seyfried <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit b2e2f0c779fefede3a871781c8827bd8e76c7c0f
Author: Andy Shevchenko <[email protected]>
Date:   Mon Nov 10 12:38:59 2014 +0200

    stmmac: split to core library and probe drivers
    
    Instead of registering the platform and PCI drivers in one module let's move
    necessary bits to where it belongs. During this procedure we convert the module
    registration part to use module_*_driver() macros which makes code simplier.
    
    >From now on the driver consists three parts: core library, PCI, and platform
    drivers.
    
    Signed-off-by: Andy Shevchenko <[email protected]>
    Acked-by: Giuseppe Cavallaro <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit dc680b989d519952e0e0d37204fec850925a0225
Author: Linus Walleij <[email protected]>
Date:   Mon Nov 10 18:52:31 2014 +0100

    ARM: fix multiplatform allmodcompile
    
    Commit 68f3b875f7848f5304472184a4634148c5330cbd
    "ARM: integrator: make the Integrator multiplatform"
    broke allmodconfig like this:
    
    >> arch/arm/include/asm/cmpxchg.h:114:2: error: #error
    "SMP is not supported on this platform"
    (etc)
    
    This is due to the fact that as we turned on multiplatform
    for the Integrator, this enabled a lot of non-applicable
    CPU's to be selected for its multiplatform images, due to
    a lot of "depends on ARCH_INTEGRATOR" restrictions in
    arch/arm/mm/Kconfig for the different ARM CPU types.
    
    Fix this by restricting the CPU selections to respective
    multiplatform config, which now becomes a subset of the
    possible Integrator configurations, or alternatively the
    non-multiplatform config plus ARCH_INTEGRATOR, i.e.:
    
    if (!ARCH_MULTIPLATFORM || ARCH_MULTI_Vx) &&
       (ARCH_INTEGRATOR || ARCH_FOO ...)
    
    Since the Integrator has been converted to multiplatform,
    this will often take the short form:
    
    if (ARCH_MULTI_Vx && ARCH_INTEGRATOR)
    
    If no other non-multiplatform platforms are elegible.
    
    Reported-by: Build bot for Mark Brown <[email protected]>
    Reported-by: Kbuild test robot <[email protected]>
    Suggested-by: Russell King <[email protected]>
    Signed-off-by: Linus Walleij <[email protected]>
    Signed-off-by: Arnd Bergmann <[email protected]>

commit ba7a46f16dd29f93303daeb1fee8af316c5a07f4
Author: Joe Perches <[email protected]>
Date:   Tue Nov 11 10:59:17 2014 -0800

    net: Convert LIMIT_NETDEBUG to net_dbg_ratelimited
    
    Use the more common dynamic_debug capable net_dbg_ratelimited
    and remove the LIMIT_NETDEBUG macro.
    
    All messages are still ratelimited.
    
    Some KERN_<LEVEL> uses are changed to KERN_DEBUG.
    
    This may have some negative impact on messages that were
    emitted at KERN_INFO that are not not enabled at all unless
    DEBUG is defined or dynamic_debug is enabled.  Even so,
    these messages are now _not_ emitted by default.
    
    This also eliminates the use of the net_msg_warn sysctl
    "/proc/sys/net/core/warnings".  For backward compatibility,
    the sysctl is not removed, but it has no function.  The extern
    declaration of net_msg_warn is removed from sock.h and made
    static in net/core/sysctl_net_core.c
    
    Miscellanea:
    
    o Update the sysctl documentation
    o Remove the embedded uses of pr_fmt
    o Coalesce format fragments
    o Realign arguments
    
    Signed-off-by: Joe Perches <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit e349d9d5b3f9509e6a053d9d1d9f4c7d9471c8f0
Author: Neelesh Gupta <[email protected]>
Date:   Wed Nov 5 16:45:14 2014 +0530

    hwmon: (ibmpowernv) Use platform 'id_table' to probe the device
    
    The current driver probe() function assumes the sensor device to be
    always present and gets executed every time if the driver is loaded,
    but the appropriate hardware could not be present.
    
    So, move the platform device creation as part of platform init code
    and use the 'id_table' to check if the device is present or not.
    
    Signed-off-by: Neelesh Gupta <[email protected]>
    Acked-by: Michael Ellerman <[email protected]>
    Signed-off-by: Guenter Roeck <[email protected]>

commit eebb2554a0a4ce8f637c72febc883997a58093ca
Author: Guenter Roeck <[email protected]>
Date:   Sat Sep 27 08:31:12 2014 -0700

    hwmon: (iio_hwmon) Add support for humidity sensors
    
    The iio subsystem supports humidity sensors, so it makes sense
    to support it in the iio-hwmon bridge as well.
    
    Cc: Jonathan Cameron <[email protected]>
    Acked-by: Jonathan Cameron <[email protected]>
    Signed-off-by: Guenter Roeck <[email protected]>

commit c2827f34af5ced95daddefd7de6105d7fcf0d4d5
Author: Alan Tull <[email protected]>
Date:   Wed Oct 15 13:55:10 2014 -0500

    hwmon: (ltc2978) Add regulator support
    
    Add simple on/off regulator support for ltc2978 and
    other pmbus parts supported by the ltc2978 driver.
    
    Signed-off-by: Alan Tull <[email protected]>
    Cc: Guenter Roeck <[email protected]>
    Cc: Mark Brown <[email protected]>
    Signed-off-by: Guenter Roeck <[email protected]>

commit 3ca7aa3feedc0cc838b242e09ff6b306501029d0
Author: Alan Tull <[email protected]>
Date:   Wed Oct 15 13:55:09 2014 -0500

    hwmon: (pmbus) Add regulator support
    
    Add support for simple on/off control of each channel.
    
    To add regulator support, the pmbus part driver needs to add
    regulator_desc information and number of regulators to its
    pmbus_driver_info struct.
    
    regulator_desc can be declared using default macro for a
    regulator (PMBUS_REGULATOR) that is in pmbus.h
    
    The regulator_init_data can be initialized from either
    platform data or the device tree.
    
    Signed-off-by: Alan Tull <[email protected]>
    Reviewed-by: Mark Brown <[email protected]>
    Signed-off-by: Guenter Roeck <[email protected]>

commit e94c450610a10a9b798b39754a6099fea5d5279e
Author: Alan Tull <[email protected]>
Date:   Wed Oct 15 13:55:08 2014 -0500

    hwmon: (pmbus) add helpers for byte write and read modify write
    
    Add two helper functions:
     * pmbus_write_byte_data  = paged byte write
     * pmbus_update_byte_data = paged byte read/modify/write
    
    Signed-off-by: Alan Tull <[email protected]>
    Cc: Mark Brown <[email protected]>
    Signed-off-by: Guenter Roeck <[email protected]>

commit 7c6d297620427048742977c2258669f3cc926f1f
Author: Alan Tull <[email protected]>
Date:   Wed Oct 15 13:55:07 2014 -0500

    hwmon: (ltc2978) device tree bindings documentation
    
    Add device tree bindings documentation for ltc2978.
    
    Signed-off-by: Alan Tull <[email protected]>
    Cc: Mark Rutland <[email protected]>
    Cc: Mark Brown <[email protected]>
    [Guenter Roeck: Minor correction of 'compatible' example]
    Signed-off-by: Guenter Roeck <[email protected]>

commit 5b61c4db49e2530ed10631321d4c73f49d560a93
Author: Denis Kirjanov <[email protected]>
Date:   Mon Nov 10 08:59:43 2014 +0300

    PPC: bpf_jit_comp: add SKF_AD_HATYPE instruction
    
    Add BPF extension SKF_AD_HATYPE to ppc JIT to check
    the hw type of the interface
    
    Before:
    [   57.723666] test_bpf: #20 LD_HATYPE
    [   57.723675] BPF filter opcode 0020 (@0) unsupported
    [   57.724168] 48 48 PASS
    
    After:
    [  103.053184] test_bpf: #20 LD_HATYPE 7 6 PASS
    
    CC: Alexei Starovoitov<[email protected]>
    CC: Daniel Borkmann<[email protected]>
    CC: Philippe Bergheaud<[email protected]>
    Signed-off-by: Denis Kirjanov <[email protected]>
    
    v2: address Alexei's comments
    Acked-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 0bd52941586b3b59ab9b6e89e55b2dc9e2680de9
Author: Aravind Gopalakrishnan <[email protected]>
Date:   Tue Nov 4 11:49:02 2014 -0600

    hwmon: (fam15h_power) Fix NB device ID for F16h M30h
    
    F3 device ID is wrongly included in fam15h_power_id_table
    for F16h M30h. It should be F4 device ID. Fix this.
    
    Signed-off-by: Aravind Gopalakrishnan <[email protected]>
    Signed-off-by: Guenter Roeck <[email protected]>

commit 48b9d5b4f408259cd6800c4b17d4fe5025435da2
Author: Kamil Debski <[email protected]>
Date:   Mon Nov 3 15:42:55 2014 +0100

    hwmon: (pwm-fan) Fix suspend/resume behavior
    
    The state of a PWM output is not clearly defined after resume. Some PWM
    drivers do not restore the duty cycle upon resume, thus it is necessary to
    manually restore the correct value.
    
    Signed-off-by: Kamil Debski <[email protected]>
    Signed-off-by: Guenter Roeck <[email protected]>

commit aab18da44f243cf59b4dee335ea50b32f529b5b0
Author: Michael Ellerman <[email protected]>
Date:   Fri Oct 31 17:45:22 2014 +1100

    hwmon: (ibmpowernv) Quieten when probing finds no device
    
    Because we build kernels with drivers built in for many platforms, it's
    normal for the ibmpowernv driver to be loaded on systems that don't have
    the appropriate hardware.
    
    Currently the driver spams the log with:
    
      ibmpowernv ibmpowernv.0: Opal node 'sensors' not found
      ibmpowernv: Platfrom driver probe failed
    
    But there is no error, this machine is not a powernv and doesn't have
    the hardware. So change the sensors message to dev_dbg(), and only print
    an error about the probe failing if it's not ENODEV.
    
    Also fix the spelling of "Platfrom" and print the actual error value.
    
    Signed-off-by: Michael Ellerman <[email protected]>
    Reviewed-by: Jean Delvare <[email protected]>
    Signed-off-by: Guenter Roeck <[email protected]>

commit a2ae6007a442d6bb27d77bf20ec1b06cda9e306e
Author: Joe Perches <[email protected]>
Date:   Sun Nov 9 16:32:46 2014 -0800

    dsa: Use netdev_<level> instead of printk
    
    Neaten and standardize the logging output.
    
    Other miscellanea:
    
    o Use pr_notice_once instead of a guard flag.
    o Convert existing pr_<level> uses too.
    
    Signed-off-by: Joe Perches <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit f4a1edd56120249198073aa4a373b77e3700ac8f
Author: Or Gerlitz <[email protected]>
Date:   Sun Nov 9 14:25:39 2014 +0200

    net/mlx4_en: Advertize encapsulation offloads features only when VXLAN tunnel is set
    
    Currenly we only support Large-Send and TX checksum offloads for
    encapsulated traffic of type VXLAN. We must make sure to advertize
    these offloads up to the stack only when VXLAN tunnel is set.
    
    Failing to do so, would mislead the the networking stack to assume
    that the driver can offload the internal TX checksum for GRE packets
    and other buggy schemes.
    
    Reported-by: Florian Westphal <[email protected]>
    Signed-off-by: Or Gerlitz <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit f8c6455bb04b944edb69e9b074e28efee2c56bdd
Author: Shani Michaeli <[email protected]>
Date:   Sun Nov 9 13:51:53 2014 +0200

    net/mlx4_en: Extend checksum offloading by CHECKSUM COMPLETE
    
    When processing received traffic, pass CHECKSUM_COMPLETE status to the
    stack, with calculated checksum for non TCP/UDP packets (such
    as GRE or ICMP).
    
    Although the stack expects checksum which doesn't include the pseudo
    header, the HW adds it. To address that, we are subtracting the pseudo
    header checksum from the checksum value provided by the HW.
    
    In the IPv6 case, we also compute/add the IP header checksum which
    is not added by the HW for such packets.
    
    Cc: Jerry Chu <[email protected]>
    Signed-off-by: Shani Michaeli <[email protected]>
    Signed-off-by: Matan Barak <[email protected]>
    Signed-off-by: Or Gerlitz <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit dd65beac48a5259945846956d4b27344dfb73bd9
Author: Shani Michaeli <[email protected]>
Date:   Sun Nov 9 13:51:52 2014 +0200

    net/mlx4_en: Extend usage of napi_gro_frags
    
    We can call napi_gro_frags for all the received traffic regardless
    of the checksum status. Specifically, received packets whose status
    is CHECKSUM_NONE (and soon to be added CHECKSUM_COMPLETE)
    are eligible for napi_gro_frags as well.
    
    Signed-off-by: Or Gerlitz <[email protected]>
    Signed-off-by: Shani Michaeli <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 242fe7a1fd7af133d4c0ae2aae1de4e33b1b39af
Author: Rafał Miłecki <[email protected]>
Date:   Wed Sep 3 07:36:51 2014 +0200

    MIPS: Fix info about plat_setup in arch_mem_init comment
    
    Signed-off-by: Rafał Miłecki <[email protected]>
    Cc: [email protected]
    Patchwork: https://patchwork.linux-mips.org/patch/7607/
    Signed-off-by: Ralf Baechle <[email protected]>

commit 5996d33df117bc3c56c28d6a930679ddcb693626
Author: Rafał Miłecki <[email protected]>
Date:   Thu Oct 30 12:50:03 2014 +0100

    MIPS: BCM47XX: Clean up nvram header
    
    1) Move private defines to the .c file
    2) Move SPROM helper to the sprom.c
    3) Drop unused code
    4) Rename magic to the NVRAM_MAGIC
    5) Add const to the char pointer we never modify
    
    Signed-off-by: Rafał Miłecki <[email protected]>
    Acked-by: Hauke Mehrtens <[email protected]>
    Cc: [email protected]
    Patchwork: https://patchwork.linux-mips.org/patch/8289/
    Signed-off-by: Ralf Baechle <[email protected]>

commit 1bb002b25f08e7e295b2c16dfc09a4cefc3cc5db
Author: Rafał Miłecki <[email protected]>
Date:   Wed Oct 29 10:05:06 2014 +0100

    MIPS: BCM47XX: Use mtd as an alternative way/API to get NVRAM content
    
    NVRAM can be read using magic memory offset, but after all it's just a
    flash partition. On platforms where NVRAM isn't needed early we can get
    it using mtd subsystem.
    
    Signed-off-by: Rafał Miłecki <[email protected]>
    Acked-by: Hauke Mehrtens <[email protected]>
    Cc: [email protected]
    Patchwork: https://patchwork.linux-mips.org/patch/8266/
    Signed-off-by: Ralf Baechle <[email protected]>

commit 2a90d4aae5509e9cf1ba848c5d0b3458201160a0
Author: Paolo Bonzini <[email protected]>
Date:   Fri Nov 7 23:04:00 2014 +0100

    blk-mq: use get_cpu/put_cpu instead of preempt_disable/preempt_enable
    
    blk-mq is using preempt_disable/enable in order to ensure that the
    queue runners are placed on the right CPU.  This does not work with
    the RT patches, because __blk_mq_run_hw_queue takes a non-raw
    spinlock with the preemption-disabled region.  If there is contention
    on the lock, this violates the rules for preemption-disabled regions.
    
    While this should be easily fixable within the RT patches just by doing
    migrate_disable/enable, we can do better and document _why_ this
    particular region runs with disabled preemption.  After the previous
    patch, it is trivial to switch it to get/put_cpu; the RT patches then
    can change it to get_cpu_light, which lets virtio-blk run under RT
    kernels.
    
    Cc: Jens Axboe <[email protected]>
    Cc: Thomas Gleixner <[email protected]>
    Reported-by: Clark Williams <[email protected]>
    Tested-by: Clark Williams <[email protected]>
    Signed-off-by: Paolo Bonzini <[email protected]>
    Signed-off-by: Jens Axboe <[email protected]>

commit 398205b8391b208f0034a392242867b28ad8af3d
Author: Paolo Bonzini <[email protected]>
Date:   Fri Nov 7 23:03:59 2014 +0100

    blk_mq: call preempt_disable/enable in blk_mq_run_hw_queue, and only if needed
    
    preempt_disable/enable surrounds every call to blk_mq_run_hw_queue,
    except the one in blk-flush.c.  In fact that one is always asynchronous,
    and it does not need smp_processor_id().
    
    We can do the same for all other calls, avoiding preempt_disable when
    async is true.  This avoids peppering blk-mq.c with preemption-disabled
    regions.
    
    Cc: Jens Axboe <[email protected]>
    Cc: Thomas Gleixner <[email protected]>
    Reported-by: Clark Williams <[email protected]>
    Tested-by: Clark Williams <[email protected]>
    Signed-off-by: Paolo Bonzini <[email protected]>
    Signed-off-by: Jens Axboe <[email protected]>

commit 9169051617df7fca597274e9e43324332cb8f0ee
Author: Mark Brown <[email protected]>
Date:   Sat Nov 8 10:28:10 2014 +0000

    spi: spidev: Don't mangle max_speed_hz in underlying spi device
    
    Currently spidev allows callers to set the default speed by overriding the
    max_speed_hz in the underlying device. This achieves the immediate goal but
    is not what devices expect and can easily lead to userspace trying to set
    unsupported speeds and succeeding, apart from anything else drivers can't
    set a limit on the speed using max_speed_hz as they'd expect and any other
    devices on the bus will be affected.
    
    Instead store the default speed in the spidev struct and fill this in on
    each transfer.
    
    Signed-off-by: Mark Brown <[email protected]>

commit 2c8c56e15df3d4c2af3d656e44feb18789f75837
Author: Eric Dumazet <[email protected]>
Date:   Tue Nov 11 05:54:28 2014 -0800

    net: introduce SO_INCOMING_CPU
    
    Alternative to RPS/RFS is to use hardware support for multiple
    queues.
    
    Then split a set of million of sockets into worker threads, each
    one using epoll() to manage events on its own socket pool.
    
    Ideally, we want one thread per RX/TX queue/cpu, but we have no way to
    know after accept() or connect() on which queue/cpu a socket is managed.
    
    We normally use one cpu per RX queue (IRQ smp_affinity being properly
    set), so remembering on socket structure which cpu delivered last packet
    is enough to solve the problem.
    
    After accept(), connect(), or even file descriptor passing around
    processes, applications can use :
    
     int cpu;
     socklen_t len = sizeof(cpu);
    
     getsockopt(fd, SOL_SOCKET, SO_INCOMING_CPU, &cpu, &len);
    
    And use this information to put the socket into the right silo
    for optimal performance, as all networking stack should run
    on the appropriate cpu, without need to send IPI (RPS/RFS).
    
    Signed-off-by: Eric Dumazet <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 3d97379a67486bc481ab5b8f7aa5b7ceb6154a95
Author: Eric Dumazet <[email protected]>
Date:   Tue Nov 11 05:54:27 2014 -0800

    tcp: move sk_mark_napi_id() at the right place
    
    sk_mark_napi_id() is used to record for a flow napi id of incoming
    packets for busypoll sake.
    We should do this only on established flows, not on listeners.
    
    This was 'working' by virtue of the socket cloning, but doing
    this on SYN packets in unecessary cache line dirtying.
    
    Even if we move sk_napi_id in the same cache line than sk_lock,
    we are working to make SYN processing lockless, so it is desirable
    to set sk_napi_id only for established flows.
    
    Signed-off-by: Eric Dumazet <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 26488b3723270880a28b542ff2276689506d6a9f
Author: Jiang Liu <[email protected]>
Date:   Thu Aug 22 20:59:39 2013 +0800

    tracing: Add entry->next_cpu to trace_ctxwake_bin()
    
    Function trace_ctxwake_bin() misses ctx_switch_entry->next_cpu field,
    so user will get stale value for "next_cpu".
    
    Link: http://lkml.kernel.org/p/[email protected]
    
    Signed-off-by: Jiang Liu <[email protected]>
    Signed-off-by: Steven Rostedt <[email protected]>

commit 243f7610a68a606eb1787c09450a440bf30bebe0
Author: Steven Rostedt (Red Hat) <[email protected]>
Date:   Thu Oct 30 20:44:53 2014 -0400

    tracing: Move tracing_sched_{switch,wakeup}() into wakeup tracer
    
    The only code that references tracing_sched_switch_trace() and
    tracing_sched_wakeup_trace() is the wakeup latency tracer. Those
    two functions use to belong to the sched_switch tracer which has
    long been removed. These functions were left behind because the
    wakeup latency tracer used them. But since the wakeup latency tracer
    is the only one to use them, they should be static functions inside
    that code.
    
    Signed-off-by: Steven Rostedt <[email protected]>

commit 458faf0b88b19a46d51bb9760fa6e03a1bc6d97b
Author: Oleg Nesterov <[email protected]>
Date:   Wed Jul 23 21:35:03 2014 +0200

    tracing: Kill the dead code in probe_sched_switch() and probe_sched_wakeup()
    
    After the previous patch it is clear that "tracer_enabled" can never be
    true, we can remove the "if (tracer_enabled)" code in probe_sched_switch()
    and probe_sched_wakeup(). Plus we can obviously remove tracer_enabled,
    ctx_trace, and sched_stopped as well.
    
    Link: http://lkml.kernel.org/p/[email protected]
    
    Signed-off-by: Oleg Nesterov <[email protected]>
    Signed-off-by: Steven Rostedt <[email protected]>

commit 632537256e9f969a188cc4d0159e0027a459d3e7
Author: Oleg Nesterov <[email protected]>
Date:   Wed Jul 23 21:35:01 2014 +0200

    tracing: Kill tracing_{start,stop}_sched_switch_record() and tracing_sched_switch_assign_trace()
    
    tracing_{start,stop}_sched_switch_record() have no callers since
    87d80de2800d "tracing: Remove obsolete sched_switch tracer".
    
    The last caller of tracing_sched_switch_assign_trace() was removed
    by 30dbb20e68e6 "tracing: Remove boot tracer".
    
    Link: http://lkml.kernel.org/p/[email protected]
    
    Signed-off-by: Oleg Nesterov <[email protected]>
    Signed-off-by: Steven Rostedt <[email protected]>

commit 4fd3279b48605ae3ea509b9b2c02e46aa0975930
Author: Steven Rostedt (Red Hat) <[email protected]>
Date:   Fri Oct 24 17:56:04 2014 -0400

    ftrace: Add more information to ftrace_bug() output
    
    With the introduction of the dynamic trampolines, it is useful that if
    things go wrong that ftrace_bug() produces more information about what
    the current state is. This can help debug issues that may arise.
    
    Ftrace has lots of checks to make sure that the state of the system it
    touchs is exactly what it expects it to be. When it detects an abnormality
    it calls ftrace_bug() and disables itself to prevent any further damage.
    It is crucial that ftrace_bug() produces sufficient information that
    can be used to debug the situation.
    
    Cc: Benjamin Herrenschmidt <[email protected]>
    Acked-by: Borislav Petkov <[email protected]>
    Tested-by: Masami Hiramatsu <[email protected]>
    Tested-by: Jiri Kosina <[email protected]>
    Signed-off-by: Steven Rostedt <[email protected]>

commit 12cce594fa8f12e002e7eb5d10141853c1e6a112
Author: Steven Rostedt (Red Hat) <[email protected]>
Date:   Thu Jul 3 15:48:16 2014 -0400

    ftrace/x86: Allow !CONFIG_PREEMPT dynamic ops to use allocated trampolines
    
    When the static ftrace_ops (like function tracer) enables tracing, and it
    is the only callback that is referencing a function, a trampoline is
    dynamically allocated to the function that calls the callback directly
    instead of calling a loop function that iterates over all the registered
    ftrace ops (if more than one ops is registered).
    
    But when it comes to dynamically allocated ftrace_ops, where they may be
    freed, on a CONFIG_PREEMPT kernel there's no way to know when it is safe
    to free the trampoline. If a task was preempted while executing on the
    trampoline, there's currently no way to know when it will be off that
    trampoline.
    
    But this is not true when it comes to !CONFIG_PREEMPT. The current method
    of calling schedule_on_each_cpu() will force tasks off the trampoline,
    becaues they can not schedule while on it (kernel preemption is not
    configured). That means it is safe to free a dynamically allocated
    ftrace ops trampoline when CONFIG_PREEMPT is not configured.
    
    Cc: H. Peter Anvin <[email protected]>
    Cc: Paul E. McKenney <[email protected]>
    Acked-by: Borislav Petkov <[email protected]>
    Tested-by: Masami Hiramatsu <[email protected]>
    Tested-by: Jiri Kosina <[email protected]>
    Signed-off-by: Steven Rostedt <[email protected]>

commit 19ca5a3cc425cc9a8abedb0f4fb7b4e7ceee2255
Author: Andreas Ruprecht <[email protected]>
Date:   Sun Aug 10 21:10:03 2014 +0200

    EDAC, pci_sysfs: remove unneccessary ifdef around entire file
    
    The file edac_pci_sysfs.c is dependent on CONFIG_PCI. This is already
    modelled in the Makefile, but edac_pci_sysfs.o is still contained in
    the list of files compiled even without CONFIG_PCI.
    
    This change removes edac_pci_sysfs.o from the list of built objects
    when not having CONFIG_PCI enabled and removes the then-unnecessary
    ifdef from the source file.
    
    Signed-off-by: Andreas Ruprecht <[email protected]>
    Link: http://lkml.kernel.org/r/[email protected]
    Signed-off-by: Borislav Petkov <[email protected]>

commit 419a2ea074189be8de0b0ab052dd98061fed1c16
Author: Mike Snitzer <[email protected]>
Date:   Tue Oct 28 20:58:45 2014 -0400

    dm thin: suspend/resume active thin devices when reloading thin-pool
    
    Before this change it was expected that userspace would first suspend
    all active thin devices, reload/resize the thin-pool target, then resume
    all active thin devices.  Now the thin-pool suspend/resume will trigger
    the suspend/resume of all active thins via appropriate calls to
    dm_internal_suspend and dm_internal_resume.
    
    Store the mapped_device for each thin device in struct thin_c to make
    these calls possible.
    
    Signed-off-by: Mike Snitzer <[email protected]>

commit 665aa8cdc499b9aeea6532e682a58ca34b7f94e6
Author: Dan Carpenter <[email protected]>
Date:   Fri Aug 1 11:25:14 2014 +0300

    ghes_edac: Use snprintf() to silence a static checker warning
    
    My static checker complains because the "e->location" has up to 256
    characters but we are copying it into the "pvt->detail_location" which
    only has space for 240 characters.  That's not counting the surrounding
    text and the "e->other_detail" string which can be over 80 characters
    long.
    
    I am not familiar with this code but presumably it normally works.
    Let's add a limit though for safety.
    
    Signed-off-by: Dan Carpenter <[email protected]>
    Acked-by: Mauro Carvalho Chehab <[email protected]>
    Link: http://lkml.kernel.org/r/20140801082514.GD28869@mwanda
    Signed-off-by: Borislav Petkov <[email protected]>

commit 8860704ea9afa699484c9fe7822da1cd37e40690
Author: Mike Snitzer <[email protected]>
Date:   Tue Oct 28 18:34:52 2014 -0400

    dm: enhance internal suspend and resume interface
    
    Rename dm_internal_{suspend,resume} to dm_internal_{suspend,resume}_fast
    -- dm-stats will continue using these methods to avoid all the extra
    suspend/resume logic that is not needed in order to quickly flush IO.
    
    Introduce dm_internal_suspend_noflush() variant that actually calls the
    mapped_device's target callbacks -- otherwise target-specific hooks are
    avoided (e.g. dm-thin's thin_presuspend and thin_postsuspend).  Common
    code between dm_internal_{suspend_noflush,resume} and
    dm_{suspend,resume} was factored out as __dm_{suspend,resume}.
    
    Update dm_internal_{suspend_noflush,resume} to always take and release
    the mapped_device's suspend_lock.  Also update dm_{suspend,resume} to be
    aware of potential for DM_INTERNAL_SUSPEND_FLAG to be set and respond
    accordingly by interruptibly waiting for the DM_INTERNAL_SUSPEND_FLAG to
    be cleared.  Add lockdep annotation to dm_suspend() and dm_resume().
    
    Also add DM_INTERNAL_SUSPEND_FLAG to status report.  This new
    DM_INTERNAL_SUSPEND_FLAG state is being tracked/reported to assist with
    debugging (e.g. 'dmsetup info' will report an internally suspended
    device accordingly).
    
    The existing DM_SUSPEND_FLAG remains unchanged.
    DM_INTERNAL_SUSPEND_FLAG is set by dm_internal_suspend_noflush() and
    cleared by dm_internal_resume().
    
    Both DM_SUSPEND_FLAG and DM_INTERNAL_SUSPEND_FLAG may be set if a device
    was already suspended when dm_internal_suspend_noflush() was called --
    this can be thought of as a "nested suspend".  A "nested suspend" can
    with legacy userspace dm-thin code that might suspend all active thin
    volumes before suspending the pool for resize.
    
    But otherwise, in the normal dm-thin-pool suspend case moving forward:
    the thin-pool will have DM_SUSPEND_FLAG set and all active thins from
    that thin-pool will have DM_INTERNAL_SUSPEND_FLAG set.
    
    Signed-off-by: Mike Snitzer <[email protected]>

commit bf735ebb898c1348f635488bee737b95886aa20e
Author: Mike Snitzer <[email protected]>
Date:   Fri Nov 7 15:09:46 2014 -0500

    dm thin: do not allow thin device activation while pool is suspended
    
    Otherwise IO could be issued to the pool while it is suspended.
    
    Care was taken to properly interlock between the thin and thin-pool
    targets when accessing the pool's 'suspended' flag.
    
    Signed-off-by: Mike Snitzer <[email protected]>

commit 3ca4517dc53569ad82152ff035be0e909c06c722
Author: Mike Snitzer <[email protected]>
Date:   Tue Oct 28 20:13:31 2014 -0400

    dm: add presuspend_undo hook to target_type
    
    The DM thin-pool target now must undo the changes performed during
    pool_presuspend() so introduce presuspend_undo hook in target_type.
    
    Signed-off-by: Mike Snitzer <[email protected]>

commit f35d0679e47ef97c6037f7aefba41f18a7865421
Author: Mike Snitzer <[email protected]>
Date:   Fri Nov 7 15:27:56 2014 -0500

    dm thin: remove stale 'trim' message in block comment above pool_message
    
    Signed-off-by: M…
aryabinin referenced this pull request in aryabinin/linux Nov 24, 2014
@hnaz
linux-next
e82a8ca 
GIT c04878ff13662bf8e5361d3f96ce3e38bf3bf1f2

commit c04878ff13662bf8e5361d3f96ce3e38bf3bf1f2
Author: Stephen Rothwell <[email protected]>
Date:   Wed Nov 19 18:49:07 2014 +1100

    sparc: io: fix for implement dummy relaxed accessor macros for writes
    
    Signed-off-by: Stephen Rothwell <[email protected]>

commit 882407763830dd34fc527dc96998bd4d124ed799
Author: Matthew Garrett <[email protected]>
Date:   Tue Feb 18 11:28:29 2014 -0500

    Change ACPI IPMI support to "default y"
    
    The ACPI IPMI driver implements IPMI operation region support for the ACPI
    core. Systems that declare ACPI operation regions may reference them at any
    time, including during kernel initialisation. These accesses will fail
    unless the ACPI IPMI driver is present, and undesirable system behaviour
    may result. Set the default to Y in order to encourage distributions and
    users to configure kernels to avoid awkward surprises.
    
    Signed-off-by: Matthew Garrett <[email protected]>
    Signed-off-by: Corey Minyard <[email protected]>

commit 0d7c4ceb16d175f719fbe728799f9a7d4fd69297
Author: Corey Minyard <[email protected]>
Date:   Mon Nov 10 21:24:45 2014 -0600

    ipmi: Handle I2C parms in the SSIF driver.
    
    Signed-off-by: Corey Minyard <[email protected]>

commit 99a7a9582a0206ca2fded95d85fddfd399cfcbe4
Author: Corey Minyard <[email protected]>
Date:   Mon Nov 10 21:10:49 2014 -0600

    i2c: Add parameters to sysfs-added i2c devices
    
    Some devices might need parameters to control their operation,
    add the ability to pass these parameters to the client.
    
    This also makes the parsing of sysfs-added I2C devices a little
    more flexible, allowing tabs and arbitrary numbers of spaces.
    
    Signed-off-by: Corey Minyard <[email protected]>

commit 451b7a67f772a923135e57e0e710f7aeed62b5bf
Author: Jeremy Kerr <[email protected]>
Date:   Wed Nov 12 15:41:05 2014 +0800

    drivers/char/ipmi: Add powernv IPMI driver
    
    This change adds an initial IPMI driver for powerpc OPAL firmware. The
    interface is exposed entirely through firmware: we have two functions to
    send and receive IPMI messages, and an interrupt notification from the
    firmware to signify that a message is available.
    
    Signed-off-by: Jeremy Kerr <[email protected]>
    Signed-off-by: Corey Minyard <[email protected]>

commit 5ad7fb122df9e16d0f3bdb3723995b70e978e035
Author: Jeremy Kerr <[email protected]>
Date:   Thu Nov 6 11:38:27 2014 +0800

    powerpc/powernv: Add OPAL IPMI interface
    
    Recent OPAL firmare adds a couple of functions to send and receive IPMI
    messages:
    
      https://github.com/open-power/skiboot/commit/b2a374da
    
    This change updates the token list and wrappers to suit, and adds the
    platform devices for any IPMI interfaces.
    
    Signed-off-by: Jeremy Kerr <[email protected]>
    Signed-off-by: Michael Ellerman <[email protected]>

commit 02b8f3c67cf074350611983f8b963d9f00b02d64
Author: Corey Minyard <[email protected]>
Date:   Mon Mar 19 16:00:55 2012 -0500

    ipmi: Add SMBus interface driver (SSIF)
    
    This patch adds the SMBus interface to the IPMI driver.
    
    Signed-off-by: Corey Minyard <[email protected]>
    
     Documentation/IPMI.txt       |   32
     drivers/char/ipmi/Kconfig    |   11
     drivers/char/ipmi/Makefile   |    1
     drivers/char/ipmi/ipmi_smb.c | 1737 +++++++++++++++++++++++++++++++++++++++++++
     4 files changed, 1769 insertions(+), 12 deletions(-)

commit 08bb7beae7fe102939fe5931222fc09e10d27cda
Author: Jean-Baptiste Maneyrol <[email protected]>
Date:   Sun Nov 16 22:45:43 2014 +0800

    HID: i2c-hid: print the correct data in dbg msg
    
    Report is received in "buffer"; fix the following i2c_hid_dbg()
    to dump data from the correct pointer.
    
    Signed-off-by: Jean-Baptiste Maneyrol <[email protected]>
    [Antonio Borneo: cleanup and rebase to v3.17]
    Signed-off-by: Antonio Borneo <[email protected]>
    Reviewed-by: Benjamin Tissoires <[email protected]>
    Signed-off-by: Jiri Kosina <[email protected]>

commit 11bf7828a59880427403e13dcff8228d67e9e0f7
Author: Joe Stringer <[email protected]>
Date:   Mon Nov 17 16:24:54 2014 -0800

    vxlan: Inline vxlan_gso_check().
    
    Suggested-by: Or Gerlitz <[email protected]>
    Signed-off-by: Joe Stringer <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit e3e3217029a35c579bf100998b43976d0b1cb8d7
Author: Rick Jones <[email protected]>
Date:   Mon Nov 17 14:04:29 2014 -0800

    icmp: Remove some spurious dropped packet profile hits from the ICMP path
    
    If icmp_rcv() has successfully processed the incoming ICMP datagram, we
    should use consume_skb() rather than kfree_skb() because a hit on the likes
    of perf -e skb:kfree_skb is not called-for.
    
    Signed-off-by: Rick Jones <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 54aeba7f06323e04d59a6053ee3c6023079667b2
Author: Fabian Frederick <[email protected]>
Date:   Mon Nov 17 22:23:17 2014 +0100

    dev_ioctl: use sizeof(x) instead of sizeof x
    
    Also remove spaces after cast.
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit e56f735913c8d3c417c65c7e7fcdd65011f8d96f
Author: Fabian Frederick <[email protected]>
Date:   Mon Nov 17 22:08:22 2014 +0100

    net/core: include linux/types.h instead of asm/types.h
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 1d2398dc7c78f32c50ee23a21ad9141e5e08a2ed
Author: Fabian Frederick <[email protected]>
Date:   Mon Nov 17 22:04:03 2014 +0100

    net: fix spelling for synchronized
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit a77b634367d4987718012b896c3d19c4cd7e8b4c
Author: Fabian Frederick <[email protected]>
Date:   Mon Nov 17 22:00:22 2014 +0100

    dccp: spelling s/reseting/resetting
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 02c31d2e56dfc6e65ebf5891cf6953e3391ce590
Author: Fabian Frederick <[email protected]>
Date:   Mon Nov 17 21:58:37 2014 +0100

    dccp: replace min/casting by min_t
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 54da7996b85b3a3e7388c5010ec0f1d866fc4830
Author: Fabian Frederick <[email protected]>
Date:   Mon Nov 17 21:54:58 2014 +0100

    dccp: remove blank lines between function/EXPORT_SYMBOL
    
    See Documentation/CodingStyle chapter 6.
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 6d80c4732bbbd8a76057337cb758ed64cf34f804
Author: Fabian Frederick <[email protected]>
Date:   Mon Nov 17 21:51:21 2014 +0100

    dccp: kerneldoc warning fixes
    
    Signed-off-by: Fabian Frederick <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit c20e599bb57bf12177cd5404d124cae0b6fc7970
Author: Lothar Waßmann <[email protected]>
Date:   Mon Nov 17 10:51:24 2014 +0100

    net: fec: remove unused return value from swap_buffer()
    
    The return value of swap_buffer() is not used by any caller, thus
    remove it.
    
    Signed-off-by: Lothar Waßmann <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 7b487d070a0edea01816135d3b1a9c8f2c069657
Author: Lothar Waßmann <[email protected]>
Date:   Mon Nov 17 10:51:23 2014 +0100

    net: fec: simplify loop counter handling in swap_buffer()
    
    Eliminate the DIV_ROUND_UP() and change the loop counter increment to
    4 instead. This results in saving 6 instructions in the functions
    assembly code.
    
    Signed-off-by: Lothar Waßmann <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit e453789a66ab152ecee80ded3279539d826c48ed
Author: Lothar Waßmann <[email protected]>
Date:   Mon Nov 17 10:51:22 2014 +0100

    net: fec: use swab32s() instead of cpu_to_be32()
    
    when swap_buffer() is being called, we know for sure, that we need to
    byte swap the data. Furthermore, this function is called for swapping
    data in both directions. Thus cpu_to_be32() is semantically not
    correct for all use cases. Use swab32s() to reflect this.
    
    Signed-off-by: Lothar Waßmann <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 6b7e4008389c8cb8140a9aef424b10048c44da39
Author: Lothar Waßmann <[email protected]>
Date:   Mon Nov 17 10:51:21 2014 +0100

    net: fec: improve access to quirk flags by copying them into fec_enet_private struct
    
    Signed-off-by: Lothar Waßmann <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 217b5844e279c279414fdeb47a89959fad1fbc8f
Author: Lothar Waßmann <[email protected]>
Date:   Mon Nov 17 10:51:20 2014 +0100

    net: fec: change type of 'bufdesc_ex' to bool
    
    fep->bufdesc_ex is treated as a boolean value, thus declare it as
    such.
    
    Signed-off-by: Lothar Waßmann <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit df406bc9c0d002ef52671dc7b6887ff1bb9142e9
Author: Lothar Waßmann <[email protected]>
Date:   Mon Nov 17 10:51:19 2014 +0100

    net: fec: properly parenthesize macro args
    
    Signed-off-by: Lothar Waßmann <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 745f42ba2a52d5b95594c24fb3755ff678f669f9
Author: Lothar Waßmann <[email protected]>
Date:   Mon Nov 17 10:51:18 2014 +0100

    net: fec: consistently use lower case chars as hex digits
    
    Signed-off-by: Lothar Waßmann <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit ea209de3dded8acd37677cf4e2f5fc06b791e052
Author: Lothar Waßmann <[email protected]>
Date:   Mon Nov 17 10:51:17 2014 +0100

    net: fec: indentation cleanup
    
    consistently use TABs for indentation
    
    Signed-off-by: Lothar Waßmann <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit be603bbb7bc12a006f1db36c338ac1c7f20c5a4a
Author: J. Bruce Fields <[email protected]>
Date:   Wed Oct 29 14:23:21 2014 -0400

    OOPS

commit 92424e9c63e5d74ff1c282258f3e5c82bf1d913b
Author: Christoph Hellwig <[email protected]>
Date:   Thu Nov 6 15:11:36 2014 -0500

    nfsd: implement DATA_SYNC4 support
    
    Signed-off-by: Christoph Hellwig <[email protected]>
    Signed-off-by: J. Bruce Fields <[email protected]>

commit 14fdfac3e8fe1f6f73578a3ea964dab2f844e52c
Author: Trond Myklebust <[email protected]>
Date:   Wed Nov 12 18:04:04 2014 -0500

    SUNRPC: Fix locking around callback channel reply receive
    
    Both xprt_lookup_rqst() and xprt_complete_rqst() require that you
    take the transport lock in order to avoid races with xprt_transmit().
    
    Signed-off-by: Trond Myklebust <[email protected]>
    Reviewed-by: Jeff Layton <[email protected]>
    Signed-off-by: J. Bruce Fields <[email protected]>

commit ffa21a408184e95424035234496ec1b0cdde4b79
Author: Jeff Layton <[email protected]>
Date:   Mon Nov 17 17:02:57 2014 -0500

    sunrpc: eliminate the XPT_DETACHED flag
    
    All it does is indicate whether a xprt has already been deleted from
    a list or not, which is unnecessary since we use list_del_init and it's
    always set and checked under the sv_lock anyway.
    
    Signed-off-by: Jeff Layton <[email protected]>
    Signed-off-by: J. Bruce Fields <[email protected]>

commit ea7aaa26273431650cb94e712c7c7cfec4306587
Author: Sebastian Hesselbarth <[email protected]>
Date:   Mon Nov 17 14:35:47 2014 +0100

    ARM: dts: berlin: enable USB on the Google Chromecast
    
    Enable usb1 on Google Chromecast which is connected to micro-USB
    plug used for external power supply, too.
    
    Signed-off-by: Antoine Tenart <[email protected]>
    Signed-off-by: Sebastian Hesselbarth <[email protected]>

commit e802b3a2bfd4f52a9b23037800fa0965aae92013
Author: Sebastian Hesselbarth <[email protected]>
Date:   Mon Nov 17 14:35:46 2014 +0100

    ARM: dts: berlin: add BG2CD nodes for USB support
    
    Adds nodes describing the Marvell Berlin BG2CD USB PHY and USB. The BG2CD
    SoC has 2 USB ChipIdea controllers, with usb0 host-only and usb1 dual-role
    capable.
    
    Signed-off-by: Antoine Tenart <[email protected]>
    Signed-off-by: Sebastian Hesselbarth <[email protected]>

commit fe354939edffe1f2579b4b372bad44e72bd9a9b3
Author: Antoine Tenart <[email protected]>
Date:   Mon Nov 17 14:35:45 2014 +0100

    ARM: dts: Berlin: enable USB on the BG2Q DMP
    
    Enable the 2 available USB PHY and USB nodes on the Marvell Berlin BG2Q
    DMP.
    
    Signed-off-by: Antoine Tenart <[email protected]>
    Signed-off-by: Sebastian Hesselbarth <[email protected]>

commit c539711ee79f997b0cdc136382167963932461b8
Author: Antoine Tenart <[email protected]>
Date:   Mon Nov 17 14:35:44 2014 +0100

    ARM: dts: berlin: add BG2Q nodes for USB support
    
    Adds nodes describing the Marvell Berlin BG2Q USB PHY and USB. The BG2Q
    SoC has 3 USB host controller, compatible with ChipIdea.
    
    Signed-off-by: Antoine Tenart <[email protected]>
    Signed-off-by: Sebastian Hesselbarth <[email protected]>

commit 81906906d8d95837c87b934a1a929cc43b61f4ee
Author: Antoine Tenart <[email protected]>
Date:   Mon Nov 17 14:33:12 2014 +0100

    ARM: berlin: do not select RESET_CONTROLLER
    
    RESET_CONTROLLER is meant to be user-selectable. To respect that,
    do not select it automatically when using ARCH_BERLIN.
    
    Signed-off-by: Antoine Tenart <[email protected]>
    Signed-off-by: Sebastian Hesselbarth <[email protected]>

commit 7943c0f329d33f531607d66f5781f2210e1e278c
Author: Alexei Starovoitov <[email protected]>
Date:   Thu Nov 13 17:36:50 2014 -0800

    bpf: remove test map scaffolding and user proper types
    
    proper types and function helpers are ready. Use them in verifier testsuite.
    Remove temporary stubs
    
    Signed-off-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit d0003ec01c667b731c139e23de3306a8b328ccf5
Author: Alexei Starovoitov <[email protected]>
Date:   Thu Nov 13 17:36:49 2014 -0800

    bpf: allow eBPF programs to use maps
    
    expose bpf_map_lookup_elem(), bpf_map_update_elem(), bpf_map_delete_elem()
    map accessors to eBPF programs
    
    Signed-off-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit ffb65f27a15583379567b6a59a9758163b7f5750
Author: Alexei Starovoitov <[email protected]>
Date:   Thu Nov 13 17:36:48 2014 -0800

    bpf: add a testsuite for eBPF maps
    
    . check error conditions and sanity of hash and array map APIs
    . check large maps (that kernel gracefully switches to vmalloc from kmalloc)
    . check multi-process parallel access and stress test
    
    Signed-off-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit a1854d6ac0008518bfc45e791172ad250999c2a2
Author: Alexei Starovoitov <[email protected]>
Date:   Thu Nov 13 17:36:47 2014 -0800

    bpf: fix BPF_MAP_LOOKUP_ELEM command return code
    
    fix errno of BPF_MAP_LOOKUP_ELEM command as bpf manpage
    described it in commit b4fc1a460f30("Merge branch 'bpf-next'"):
    -----
    BPF_MAP_LOOKUP_ELEM
        int bpf_lookup_elem(int fd, void *key, void *value)
        {
            union bpf_attr attr = {
                .map_fd = fd,
                .key = ptr_to_u64(key),
                .value = ptr_to_u64(value),
            };
    
            return bpf(BPF_MAP_LOOKUP_ELEM, &attr, sizeof(attr));
        }
        bpf() syscall looks up an element with given key in  a  map  fd.
        If  element  is found it returns zero and stores element's value
        into value.  If element is not found  it  returns  -1  and  sets
        errno to ENOENT.
    
    and further down in manpage:
    
       ENOENT For BPF_MAP_LOOKUP_ELEM or BPF_MAP_DELETE_ELEM,  indicates  that
              element with given key was not found.
    -----
    
    In general all BPF commands return ENOENT when map element is not found
    (including BPF_MAP_GET_NEXT_KEY and BPF_MAP_UPDATE_ELEM with
     flags == BPF_MAP_UPDATE_ONLY)
    
    Subsequent patch adds a testsuite to check return values for all of
    these combinations.
    
    Signed-off-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 28fbcfa08d8ed7c5a50d41a0433aad222835e8e3
Author: Alexei Starovoitov <[email protected]>
Date:   Thu Nov 13 17:36:46 2014 -0800

    bpf: add array type of eBPF maps
    
    add new map type BPF_MAP_TYPE_ARRAY and its implementation
    
    - optimized for fastest possible lookup()
      . in the future verifier/JIT may recognize lookup() with constant key
        and optimize it into constant pointer. Can optimize non-constant
        key into direct pointer arithmetic as well, since pointers and
        value_size are constant for the life of the eBPF program.
        In other words array_map_lookup_elem() may be 'inlined' by verifier/JIT
        while preserving concurrent access to this map from user space
    
    - two main use cases for array type:
      . 'global' eBPF variables: array of 1 element with key=0 and value is a
        collection of 'global' variables which programs can use to keep the state
        between events
      . aggregation of tracing events into fixed set of buckets
    
    - all array elements pre-allocated and zero initialized at init time
    
    - key as an index in array and can only be 4 byte
    
    - map_delete_elem() returns EINVAL, since elements cannot be deleted
    
    - map_update_elem() replaces elements in an non-atomic way
      (for atomic updates hashtable type should be used instead)
    
    Signed-off-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 0f8e4bd8a1fc8c4185f1630061d0a1f2d197a475
Author: Alexei Starovoitov <[email protected]>
Date:   Thu Nov 13 17:36:45 2014 -0800

    bpf: add hashtable type of eBPF maps
    
    add new map type BPF_MAP_TYPE_HASH and its implementation
    
    - maps are created/destroyed by userspace. Both userspace and eBPF programs
      can lookup/update/delete elements from the map
    
    - eBPF programs can be called in_irq(), so use spin_lock_irqsave() mechanism
      for concurrent updates
    
    - key/value are opaque range of bytes (aligned to 8 bytes)
    
    - user space provides 3 configuration attributes via BPF syscall:
      key_size, value_size, max_entries
    
    - map takes care of allocating/freeing key/value pairs
    
    - map_update_elem() must fail to insert new element when max_entries
      limit is reached to make sure that eBPF programs cannot exhaust memory
    
    - map_update_elem() replaces elements in an atomic way
    
    - optimized for speed of lookup() which can be called multiple times from
      eBPF program which itself is triggered by high volume of events
      . in the future JIT compiler may recognize lookup() call and optimize it
        further, since key_size is constant for life of eBPF program
    
    Signed-off-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 3274f52073d88b62f3c5ace82ae9d48546232e72
Author: Alexei Starovoitov <[email protected]>
Date:   Thu Nov 13 17:36:44 2014 -0800

    bpf: add 'flags' attribute to BPF_MAP_UPDATE_ELEM command
    
    the current meaning of BPF_MAP_UPDATE_ELEM syscall command is:
    either update existing map element or create a new one.
    Initially the plan was to add a new command to handle the case of
    'create new element if it didn't exist', but 'flags' style looks
    cleaner and overall diff is much smaller (more code reused), so add 'flags'
    attribute to BPF_MAP_UPDATE_ELEM command with the following meaning:
     #define BPF_ANY	0 /* create new element or update existing */
     #define BPF_NOEXIST	1 /* create new element if it didn't exist */
     #define BPF_EXIST	2 /* update existing element */
    
    bpf_update_elem(fd, key, value, BPF_NOEXIST) call can fail with EEXIST
    if element already exists.
    
    bpf_update_elem(fd, key, value, BPF_EXIST) can fail with ENOENT
    if element doesn't exist.
    
    Userspace will call it as:
    int bpf_update_elem(int fd, void *key, void *value, __u64 flags)
    {
        union bpf_attr attr = {
            .map_fd = fd,
            .key = ptr_to_u64(key),
            .value = ptr_to_u64(value),
            .flags = flags;
        };
    
        return bpf(BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr));
    }
    
    First two bits of 'flags' are used to encode style of bpf_update_elem() command.
    Bits 2-63 are reserved for future use.
    
    Signed-off-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 2d791d2259d465ba1669a4cf3d7395d54f5e9772
Author: Ralf Baechle <[email protected]>
Date:   Tue Nov 18 18:47:13 2014 +0100

    MIPS: Zero variable read by get_user / __get_user in case of an error.
    
    This wasn't happening in all cases.
    
    Signed-off-by: Ralf Baechle <[email protected]>

commit cadaecd2188b99d93de676150007f0e097223232
Author: Denis Kirjanov <[email protected]>
Date:   Mon Nov 17 23:07:41 2014 +0300

    PPC: bpf_jit_comp: Unify BPF_MOD | BPF_X and BPF_DIV | BPF_X
    
    Reduce duplicated code by unifying
    BPF_ALU | BPF_MOD | BPF_X and BPF_ALU | BPF_DIV | BPF_X
    
    CC: Alexei Starovoitov<[email protected]>
    CC: Daniel Borkmann<[email protected]>
    CC: Philippe Bergheaud<[email protected]>
    Signed-off-by: Denis Kirjanov <[email protected]>
    Acked-by: Alexei Starovoitov <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit a0e27f51ba8a04125c22a95c4d3e98297a7191de
Author: Soren Brinkmann <[email protected]>
Date:   Thu Nov 6 07:38:51 2014 -0800

    documentation: pinctrl bindings: Fix trivial typo 'abitrary'
    
    A misspelled 'arbitrary' propagated to quite a few locations in the DT
    binding documentation for pin-controllers. Fixing by:
      git grep abitrary | cut -f1 -d: | xargs sed -i 's/abitrary/arbitrary/'
    
    Reported-by: Andreas Färber <[email protected]>
    Signed-off-by: Soren Brinkmann <[email protected]>
    Signed-off-by: Rob Herring <[email protected]>

commit 5641c09226f401ee054e48521707fb185380e8d3
Author: bpqw <[email protected]>
Date:   Wed Nov 12 14:26:42 2014 +0000

    devicetree: bindings: Add vendor prefix for Micron Technology, Inc.
    
    This patch is used to add vendor prefix for Micron Technology, Inc. in
    the vendor-prefixes.txt file.
    
    Micron Technology, Inc. is an American multinational corporation based
    in Boise, Idaho, best known for producing many forms of semiconductor
    devices. This includes DRAM, SDRAM, flash memory, eMMC and SSDs.
    
    Signed-off-by: Bean Huo <[email protected]>
    [robh: cleanup commit msg formatting and company name]
    Signed-off-by: Rob Herring <[email protected]>

commit f9cb89b63db8cb2755a5179843a0643cc284f1ef
Author: Philipp Zabel <[email protected]>
Date:   Wed May 14 11:24:43 2014 +0200

    of: Add vendor prefix for Chips&Media, Inc.
    
    Chips&Media is a developer of Video Codec IP cores.
    
    Signed-off-by: Philipp Zabel <[email protected]>
    [robh: fix-up alphabetical ordering]
    Signed-off-by: Rob Herring <[email protected]>

commit 746c9e9f92dde2789908e51a354ba90a1962a2eb
Author: Benjamin Herrenschmidt <[email protected]>
Date:   Fri Nov 14 17:55:03 2014 +1100

    of/base: Fix PowerPC address parsing hack
    
    We have a historical hack that treats missing ranges properties as the
    equivalent of an empty one. This is needed for ancient PowerMac "bad"
    device-trees, and shouldn't be enabled for any other PowerPC platform,
    otherwise we get some nasty layout of devices in sysfs or even
    duplication when a set of otherwise identically named devices is
    created multiple times under a different parent node with no ranges
    property.
    
    This fix is needed for the PowerNV i2c busses to be exposed properly
    and will fix a number of other embedded cases.
    
    Signed-off-by: Benjamin Herrenschmidt <[email protected]>
    CC: <[email protected]>
    Acked-by: Grant Likely <[email protected]>
    Signed-off-by: Rob Herring <[email protected]>

commit 9b6eab07588c2de102423fe99c875fc4bfda2508
Author: Antony Pavlov <[email protected]>
Date:   Sun Nov 9 01:37:34 2014 +0300

    devicetree: vendor-prefixes.txt: fix whitespace
    
    Signed-off-by: Antony Pavlov <[email protected]>
    Signed-off-by: Rob Herring <[email protected]>

commit ab74d00a39f70e1bc34a01322bb59f3750ca7a8c
Author: Kevin Cernekee <[email protected]>
Date:   Sun Nov 9 00:55:47 2014 -0800

    of: Fix crash if an earlycon driver is not found
    
    __earlycon_of_table_sentinel.compatible is a char[128], not a pointer, so
    it will never be NULL.  Checking it against NULL causes the match loop to
    run past the end of the array, and eventually match a bogus entry, under
    the following conditions:
    
     - Kernel command line specifies "earlycon" with no parameters
     - DT has a stdout-path pointing to a UART node
     - The UART driver doesn't use OF_EARLYCON_DECLARE (or maybe the console
       driver is compiled out)
    
    Fix this by checking to see if match->compatible is a non-empty string.
    
    Signed-off-by: Kevin Cernekee <[email protected]>
    Cc: <[email protected]> # 3.16+
    Signed-off-by: Rob Herring <[email protected]>

commit 66865de4314caca30598244b86817e774c188afa
Author: Bjorn Helgaas <[email protected]>
Date:   Sat Nov 1 17:35:31 2014 -0600

    of/irq: Drop obsolete 'interrupts' vs 'interrupts-extended' text
    
    a9ecdc0fdc54 ("of/irq: Fix lookup to use 'interrupts-extended' property
    first") updated the description to say that:
    
      - Both 'interrupts' and 'interrupts-extended' may be present
      - Software should prefer 'interrupts-extended'
      - Software that doesn't comprehend 'interrupts-extended' may use
        'interrupts'
    
    But there is still a paragraph at the end that prohibits having both and
    says 'interrupts' should be preferred.
    
    Remove the contradictory text.
    
    Fixes: a9ecdc0fdc54 ("of/irq: Fix lookup to use 'interrupts-extended' property first")
    Signed-off-by: Bjorn Helgaas <[email protected]>
    CC: [email protected]	# v3.13+
    Acked-by: Brian Norris <[email protected]>
    Acked-by: Mark Rutland <[email protected]>
    Signed-off-by: Rob Herring <[email protected]>

commit 27b3383a1432127bfcf9f8a63bf184ff4d866141
Author: Geert Uytterhoeven <[email protected]>
Date:   Wed Oct 22 11:49:01 2014 +0200

    of: Spelling s/stucture/structure/
    
    Signed-off-by: Geert Uytterhoeven <[email protected]>
    Cc: Grant Likely <[email protected]>
    Cc: Rob Herring <[email protected]>
    Signed-off-by: Rob Herring <[email protected]>

commit f2a306c29d024193b1272cd014108882f7887a9e
Author: Robert Jarzmik <[email protected]>
Date:   Fri Sep 26 00:26:27 2014 +0200

    devicetree: bindings: add sandisk to the vendor prefixes
    
    Add sandisk to the list of vendors. This prefix should be used
    also for companies absorbed by Sandisk, like M-Systems.
    
    Signed-off-by: Robert Jarzmik <[email protected]>
    Signed-off-by: Rob Herring <[email protected]>

commit 00e4c3b6e285da90e736fbefff3d9e74a200ee54
Author: Charles Keepax <[email protected]>
Date:   Tue Nov 18 16:25:27 2014 +0000

    ASoC: wm_adsp: Move core_ena to be co-located with start bit
    
    Many firmwares do not wait for the start bit before they begin
    processing audio, whilst this is a bug on the firmware side there are
    too many such firmwares in the wild to ignore the situation. This patch
    moves the core enable to happen at same time as the start, the firmware
    looses the ability to overlap its own startup with the audio path bring
    up but we ensure that all firmwares behave.
    
    Signed-off-by: Charles Keepax <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 17c1861eabd12f28c24d4929efcc8aba8920b88f
Author: Alexey Ishchuk <[email protected]>
Date:   Fri Nov 14 14:27:58 2014 +0100

    s390/kernel: add system calls for access PCI memory
    
    Add the new __NR_s390_pci_mmio_write and __NR_s390_pci_mmio_read
    system calls to allow user space applications to access device PCI I/O
    memory pages on s390x platform.
    
    [ Martin Schwidefsky: some code beautification ]
    
    Signed-off-by: Alexey Ishchuk <[email protected]>
    Signed-off-by: Martin Schwidefsky <[email protected]>

commit 6d1e2e1783deecb7b922716295ca17deebbd3d0e
Author: Martin Schwidefsky <[email protected]>
Date:   Fri Nov 14 16:37:47 2014 +0100

    s390: fix ptrace of user area if the inferior uses vector registers
    
    The floating point registers f a process that uses vector instruction are
    not store into task->thread.fp_regs anymore but in the upper halves of the
    first 16 vector registers.
    The ptrace interface for the peeks and pokes to the user area fails to take
    this into account. Fix __peek_user[_compat] and __poke_user[_compat]
    to use the vector array for the floating pointer register if the process
    has one.
    
    Signed-off-by: Martin Schwidefsky <[email protected]>

commit afaa7d29bc04bf0fcf2e7bda2a802392a38d059b
Author: Sebastian Ott <[email protected]>
Date:   Fri Nov 14 11:01:37 2014 +0100

    s390/irq: use irq 0
    
    Irq 0 is currently unused on s390. Since there is no reason to
    do this start counting at the beginning and gain an additional
    irq. Also correctly report the smallest usable irq number for
    dynamic allocation.
    
    Signed-off-by: Sebastian Ott <[email protected]>
    Signed-off-by: Martin Schwidefsky <[email protected]>

commit 99e97b7106d492a3cac4f7963f4a89935d2fbca4
Author: Frank Blaschka <[email protected]>
Date:   Thu Nov 6 13:17:06 2014 +0100

    s390/io: add ioport_map stubs
    
    add ioport_map stubs to make vfio build on s390.
    
    Signed-off-by: Frank Blaschka <[email protected]>
    Signed-off-by: Martin Schwidefsky <[email protected]>

commit a6b42afa3fc452339e157ad5245320804cf1206f
Author: Thomas Huth <[email protected]>
Date:   Tue Oct 28 15:12:23 2014 +0100

    s390/docs: Remove sections that are not related to s390
    
    Information how to use the GCC pre-processor, objdump, strace, top, etc.
    are generic and not specific to the S390 architecture, so we do not need
    this information in Debugging390.txt
    
    Signed-off-by: Thomas Huth <[email protected]>
    Signed-off-by: Martin Schwidefsky <[email protected]>

commit b19556231156ce3e58ffd677747bf3ef7890a937
Author: Thomas Huth <[email protected]>
Date:   Fri Oct 31 14:10:14 2014 +0100

    s390/docs: Fix the documentation of the address spaces
    
    The information about the address spaces was completely outdated, since
    the usage of the address spaces changed quite a bit since the early days.
    This patch now updates the information about the usage of the address
    spaces, mostly by using the description from Heiko's patch "rework uaccess
    code - fix locking issues" (457f2180951cdcbfb4657ddcc83b486e93497f56).
    
    Signed-off-by: Thomas Huth <[email protected]>
    Signed-off-by: Martin Schwidefsky <[email protected]>

commit 5f217f905bc5e9d609d0aac830736bcfc087c7f5
Author: Takashi Sakamoto <[email protected]>
Date:   Tue Nov 18 23:59:40 2014 +0900

    ALSA: firewire-lib: fix kerneldoc errors
    
    Complete missing parameters, correct wrong reference, and add an explaination
    about the differences between the latest specification and our implementation.
    
    Signed-off-by: Takashi Sakamoto <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>

commit d6d521799fac14e14dead4e9428158340ff6b95f
Author: JS Park <[email protected]>
Date:   Tue Nov 18 16:07:22 2014 +0000

    ASoC: wm_adsp: Fix memory leak in wm_adsp_setup_algs
    
    Signed-off-by: JS Park <[email protected]>
    Signed-off-by: Charles Keepax <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 139768895309c6c1d6913e909e9c9422f81a1640
Author: Jens Axboe <[email protected]>
Date:   Tue Nov 18 08:45:31 2014 -0700

    NVMe: enable IO stats by default
    
    Before the blk-mq conversion they were on by default, we should
    not change behavior there.
    
    Signed-off-by: Jens Axboe <[email protected]>

commit a5a267cf9ca9937b0ef946b502657ae7638282f6
Author: Sudip Mukherjee <[email protected]>
Date:   Tue Nov 18 17:42:54 2014 +0530

    ASoC: rt286: build warning of section mismatch
    
    while building we were getting the following build warning:
    
    Section mismatch in reference from the function rt286_i2c_probe()
    to the variable .init.data:force_combo_jack_table
    The function rt286_i2c_probe() references
    the variable __initdata force_combo_jack_table.
    This is often because rt286_i2c_probe lacks a __initdata
    annotation or the annotation of force_combo_jack_table is wrong.
    
    we were getting the warning as force_combo_jack_table was marked
    with __initdata
    
    Signed-off-by: Sudip Mukherjee <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 358a8bb5628420529e4f0b77068155ca8fa8973b
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:53 2014 +0100

    ASoC: ac97: Push snd_ac97 pointer to the driver level
    
    Now that the ASoC core no longer needs a handle to the AC'97 device that is
    associated with a CODEC we can remove it from the snd_soc_codec struct and
    push it into the individual driver state structs like we do for other
    communication buses. Doing so creates a clean separation between the AC'97
    bus support and the ASoC core.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Acked-by: Charles Keepax <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit bc2632140435cc84f9817f1c362479b23dbdfebc
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:52 2014 +0100

    ASoC: Rename snd_soc_dai_driver struct ac97_control field to bus_control
    
    Setting the ac97_control field on a CPU DAI tells the ASoC core that this
    DAI in addition to audio data also transports control data to the CODEC.
    This causes the core to suspend the DAI after the CODEC and resume it before
    the CODEC so communication to the CODEC is still possible. This is not
    necessarily something that is specific to AC'97 and can be used by other
    buses with the same requirement. This patch renames the flag from
    ac97_control to bus_control to make this explicit.
    
    While we are at it also change the type from int to bool.
    
    The following semantich patch was used for automatic conversion of the
    drivers:
    // <smpl>
    @@
    identifier drv;
    @@
    struct snd_soc_dai_driver drv = {
    -	.ac97_control
    +	.bus_control
    	=
    -	1
    +	true
    };
    // </smpl>
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 4bafcf074aca3bd191e4d93c6a140ca52654f192
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:51 2014 +0100

    ASoC: Drop ac97_control initialization from CODEC driver DAIs
    
    This is no longer necessary as there is no code anymore that uses this for
    CODEC DAIs.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Acked-by: Charles Keepax <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 6794f709b7124ff1e574c4f4c9494418ab56c4b4
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:50 2014 +0100

    ASoC: ac97: Drop delayed device registration
    
    We have all the information and dependencies we need to initialize and
    register the device available in snd_soc_new_ac97_codec(). So there is no
    need to delay the device registration until after the card itself as been
    registered.
    
    This makes the code significantly simpler and also makes it possible to use
    the AC'97 device in the CODECs probe function. The later will be required to
    be able to convert the AC'97 CODEC drivers to regmap.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit ca005f324ee38308b319c693f40523d959027acf
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:49 2014 +0100

    ASoC: ac97: Drop support for setting platform data via the CPU DAI
    
    This has no users since commit f0fba2ad1b6b ("ASoC: multi-component - ASoC
    Multi-Component Support") which was almost 5 years ago. Given that this runs
    after CODEC probe functions have been run it also doesn't seem to be that
    useful.
    
    So drop it altogether to make the code simpler.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit bdfd60e3c0affb914549f1d22e8aeef71e7828e6
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:48 2014 +0100

    ASoC: ac97: Merge soc_ac97_dev_{un,}register()/soc_{un,}register_ac97_codec()
    
    soc_{un,}register_ac97_codec() is just a simple wrapper around
    soc_ac97_dev_{un,}register(). There is no need to split these up into two
    different sets of functions.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit eda1a701fd9589b6ed15b109558bd4f6202e3829
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:47 2014 +0100

    ASoC: ac97: Use static ac97_bus
    
    We always pass soc_ac97_ops to snd_soc_new_ac97_codec(). So instead of
    allocating a snd_ac97_bus in snd_soc_new_ac97_codec() just use a static one
    that gets initialized when snd_soc_set_ac97_ops() is called.
    
    Also drop the device number parameter from snd_soc_new_ac97_codec(). We
    currently only support one device per bus and all drivers pass 0 for the
    device number. And if we should ever support multiple devices per bus it
    wouldn't be up to individual AC'97 device drivers to pick their number, but
    rather either the AC'97 adapter driver or the core code will assign them.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Acked-by: Charles Keepax <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 336b8423e285174ebecf02a743d69913b83bbc48
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:46 2014 +0100

    ASoC: Move AC'97 support to its own file
    
    Currently the AC'97 support is splattered all throughout soc-core.c. Some
    parts are #ifdef'd some parts are not. This patch moves the AC'97 support to
    its own file, this should make the code a bit more clearer and also makes it
    possible to easily not compile it into the kernel when not needed.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 70f3af3ca15affaef3d026a5aa6e44c4627ea6c7
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:45 2014 +0100

    ASoC: Properly handle AC'97 device lifetime management
    
    The memory that a struct device is contained in must not be freed except
    from within the device's release callback. The ASoC code currently does not
    adhere to this rule for the AC'97 device. This patch fixes it by moving the
    freeing of the AC'97 to the release callback and splitting up the
    registration and unregistration of the device into separate steps for
    getting/putting the reference to the device and adding/removing it to the
    device hierarchy.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 65c72efd1ea370f0311a5d89754996fff9fc0747
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:44 2014 +0100

    ASoC: mpc5200_dma: Don't overwrite ac97 device private_data
    
    The mpc5200_dma overwrites the private_data field of the CODEC's AC'97
    device with the DMA drivers private data, but never actually reads it again.
    Given that the private_data field is supposed to be owned by the AC'97
    driver, overwriting it may cause undefined behavior. This patch removes the
    code that overwrites the field from the driver.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 35480e3536cdab1ee1976675e798f16d707f5356
Author: Lars-Peter Clausen <[email protected]>
Date:   Mon Nov 10 22:41:43 2014 +0100

    ASoC: mpc5200_psc_ac97: Remove unused on-stack snd_ac97 device
    
    The mpc5200_psc_ac97 driver puts a snd_ac97 device on the stack in the
    driver probe function, initializes the private data member of the device and
    the never uses the device again. It should be safe to remove it.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 77c1aa84de0096792de673aa1c64c36b38553cf5
Author: Daniel Vetter <[email protected]>
Date:   Tue Nov 18 13:27:07 2014 +0100

    drm/i915: Don't print header in error state for non-existing CS
    
    This goes back to
    
    commit 362b8af7ad1d91266aa4931e62be45c1e5cf753b
    Author: Ben Widawsky <[email protected]>
    Date:   Thu Jan 30 00:19:38 2014 -0800
    
        drm/i915: Move per ring error state to ring_error
    
    Spotted while reading error states.
    
    Cc: Ben Widawsky <[email protected]>
    Cc: Chris Wilson <[email protected]>
    Reviewed-by: Chris Wilson <[email protected]>
    Signed-off-by: Daniel Vetter <[email protected]>

commit 6dcc0cf6cb3120cedc0d4c12171894f3d6415981
Author: Jens Axboe <[email protected]>
Date:   Tue Nov 18 08:21:18 2014 -0700

    NVMe: nvme_submit_async_admin_req() must use atomic rq allocation
    
    We are called for async event notification issues, and the
    nvmeq lock is already held. If we fail the request allocation,
    we'll just retry next time.
    
    Reported-by: Julia Lawall <[email protected]>
    Signed-off-by: Jens Axboe <[email protected]>

commit 30021e3707a75cc29dc1252c062d374151c5985f
Author: Beniamino Galvani <[email protected]>
Date:   Thu Nov 13 20:32:01 2014 +0100

    i2c: add support for Amlogic Meson I2C controller
    
    This is a driver for the I2C controller found in Amlogic Meson SoCs.
    
    Signed-off-by: Beniamino Galvani <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit c9449affad2ae0824927df5a207705e07f346fb1
Author: Gerlando Falauto <[email protected]>
Date:   Thu Nov 13 14:39:56 2014 +0100

    i2c: mux: create "channel-n" symlinks for child segments in the mux device
    
    This makes the topology clearer. For instance, by adding a pca9547
    device with address 0x70 to bus i2c-0, you get:
    
    /sys/class/i2c-dev/i2c-0/device/0-0070/channel-0 -> i2c-1
    ...
    /sys/class/i2c-dev/i2c-0/device/0-0070/channel-7 -> i2c-8
    
    Signed-off-by: Gerlando Falauto <[email protected]>
    [wsa: simplified sysfs-usage and fixed format string usage]
    Signed-off-by: Wolfram Sang <[email protected]>
    Acked-by: Martin Belanger <[email protected]>
    Acked-by: Danielle Costantino <[email protected]>

commit 51cf3b0e2a72bb08cd280be6c0ead4e08ed50a2c
Author: Wolfram Sang <[email protected]>
Date:   Thu Nov 13 14:39:55 2014 +0100

    i2c: mux: create symlink to actual mux device
    
    The current implementation creates muxed i2c-<n> busses as immediate
    children of their i2c-<n> parent bus. In case of multiple muxes on one
    bus, it is impossible to determine which muxed bus comes from which mux.
    
    It could be argued that the parent device should be changed from the
    parent adapter to the mux device. This has pros and cons. To improve the
    topology, simply add a "mux_device" symlink pointing to the actual
    muxing device, so we can distinguish muxed busses. Doing it this way, we
    don't break the ABI.
    
    Signed-off-by: Wolfram Sang <[email protected]>
    Tested-by: Guenter Roeck <[email protected]>

commit 4470c725ba7b86481c31466640ab487f927de6b7
Author: Wolfram Sang <[email protected]>
Date:   Tue Nov 18 15:12:43 2014 +0100

    i2c: acpi: remove unneeded variable initialization
    
    No need to initialize 'ret' if it gets assigned directly after that.
    
    Signed-off-by: Wolfram Sang <[email protected]>
    Acked-by: Mika Westerberg <[email protected]>

commit bb29a93b38610d2adc6ead40b75e1a1991617550
Author: Masanari Iida <[email protected]>
Date:   Wed Nov 12 00:52:23 2014 +0900

    ASoC: jack: Fix warning while make htmldocs caused by soc-jack.c
    
    This patch fix following errors while "make htmldocs" on
    linux-next-20141110.
    
    Warning(.//sound/soc/soc-jack.c:126): No description found for
    parameter 'zones'
    Warning(.//sound/soc/soc-jack.c:126): Excess function parameter
    'zone' description in 'snd_soc_jack_add_zones'
    
    Signed-off-by: Masanari Iida <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit ce1a78840ff7ab846065d5b65eaac959bafe1949
Author: Yao Yuan <[email protected]>
Date:   Tue Nov 18 18:31:06 2014 +0800

    i2c: imx: add DMA support for freescale i2c driver
    
    Add dma support for i2c. This function depend on DMA driver.
    You can turn on it by write both the dmas and dma-name properties in dts node.
    DMA is optional, even DMA request unsuccessfully, i2c can also work well.
    
    Signed-off-by: Yuan Yao <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit 2fbed5119d6a07a6777b2131262587df338df22b
Author: Yao Yuan <[email protected]>
Date:   Tue Nov 18 18:31:05 2014 +0800

    i2c: imx: Sort include headers alphabetically
    
    If the inlcude headers aren't sorted alphabetically, then the
    logical choice is to append new ones, however that creates a
    lot of potential for conflicts or duplicates because every change
    will then add new includes in the same location.
    
    Signed-off-by: Yuan Yao <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit fcc50e5cd2deb8316d19e446d8efdfc9b35646ef
Author: Qipan Li <[email protected]>
Date:   Mon Nov 17 23:17:03 2014 +0800

    spi: sirf: assign spi_master's max_speed_hz member
    
    if spi device has no frequency, spi core will setup the default frequency
    to max_speed_hz of spi_master according to
    int spi_setup(struct spi_device *spi)
    {
    	...
            if (!spi->max_speed_hz)
                    spi->max_speed_hz = spi->master->max_speed_hz;
    	...
    }
    this patch moves CSR SiRFSoC SPI frequency set to follow SPI core behaviour.
    
    Signed-off-by: Qipan Li <[email protected]>
    Signed-off-by: Barry Song <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit 9c4b19a07dddda3ba35a2eb9b4134d485908e2f5
Author: Qipan Li <[email protected]>
Date:   Mon Nov 17 23:17:02 2014 +0800

    spi: sirf: fix word width configuration
    
    commit 8c328a262f ("spi: sirf: Avoid duplicate code in various
    bits_per_word cases") is wrong in setting data width register of
    fifo is not right, it should use sspi->word_width >> 1 to set
    related bits. According to hardware spec, the mapping between
    register value and data width:
    0 - byte
    1 - WORD
    2 - DWORD
    
    Fixes: 8c328a262f ("spi: sirf: Avoid duplicate code in various bits_per_word cases") is wrong in setting data width register of
    Signed-off-by: Qipan Li <[email protected]>
    Signed-off-by: Barry Song <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>
    Cc: [email protected]

commit 864b94adfcba752aa902ee34497bbe58b97aa8d3
Author: Jiang Liu <[email protected]>
Date:   Sun Nov 9 22:48:03 2014 +0800

    pci, ACPI, iommu: Enhance pci_root to support DMAR device hotplug
    
    Finally enhance pci_root driver to support DMAR device hotplug when
    hot-plugging PCI host bridges.
    
    Signed-off-by: Jiang Liu <[email protected]>
    Reviewed-by: Yijing Wang <[email protected]>
    Acked-by: Bjorn Helgaas <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>

commit 30badc9543490f41497c42f004db02f1e8a29341
Author: Markus Elfring <[email protected]>
Date:   Tue Nov 18 11:31:23 2014 +0100

    GFS2: Deletion of unnecessary checks before two function calls
    
    The functions iput() and put_pid() test whether their argument is NULL
    and then return immediately. Thus the test around the call is not needed.
    
    This issue was detected by using the Coccinelle software.
    
    Signed-off-by: Markus Elfring <[email protected]>
    Signed-off-by: Steven Whitehouse <[email protected]>

commit 0690cbd2e55a72a8eae557c389d1a136ed9fa142
Author: Joerg Roedel <[email protected]>
Date:   Wed Nov 5 15:28:30 2014 +0100

    powerpc/iommu: Rename iommu_[un]map_sg functions
    
    The IOMMU-API gained support for a new iommu_map_sg
    function. This causes compile failures on powerpc because
    the function name is already globally used there.
    This patch renames adds a ppc_ prefix to these functions to
    solve the compile problem.
    
    Signed-off-by: Joerg Roedel <[email protected]>

commit ffebeb46dd34736c90ffbca1ccb0bef8f4827c44
Author: Jiang Liu <[email protected]>
Date:   Sun Nov 9 22:48:02 2014 +0800

    iommu/vt-d: Enhance intel-iommu driver to support DMAR unit hotplug
    
    Implement required callback functions for intel-iommu driver
    to support DMAR unit hotplug.
    
    Signed-off-by: Jiang Liu <[email protected]>
    Reviewed-by: Yijing Wang <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>

commit 51acce33c4df6ee23b5ad4c2e6c239e0d6f25771
Author: Jiang Liu <[email protected]>
Date:   Sun Nov 9 22:48:01 2014 +0800

    iommu/vt-d: Enhance error recovery in function intel_enable_irq_remapping()
    
    Enhance error recovery in function intel_enable_irq_remapping()
    by tearing down all created data structures.
    
    Signed-off-by: Jiang Liu <[email protected]>
    Reviewed-by: Yijing Wang <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>

commit a7a3dad944344caf034699b0c0e8dc51b469cf20
Author: Jiang Liu <[email protected]>
Date:   Sun Nov 9 22:48:00 2014 +0800

    iommu/vt-d: Enhance intel_irq_remapping driver to support DMAR unit hotplug
    
    Implement required callback functions for intel_irq_remapping driver
    to support DMAR unit hotplug.
    
    Signed-off-by: Jiang Liu <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>

commit d35165a955f095095cdb8512cb7cd8f63101649a
Author: Jiang Liu <[email protected]>
Date:   Sun Nov 9 22:47:59 2014 +0800

    iommu/vt-d: Search for ACPI _DSM method for DMAR hotplug
    
    According to Intel VT-d specification, _DSM method to support DMAR
    hotplug should exist directly under corresponding ACPI object
    representing PCI host bridge. But some BIOSes doesn't conform to
    this, so search for _DSM method in the subtree starting from the
    ACPI object representing the PCI host bridge.
    
    Signed-off-by: Jiang Liu <[email protected]>
    Reviewed-by: Yijing Wang <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>

commit 6b1972493a84f8fe13ff9d202745590f6c53d670
Author: Jiang Liu <[email protected]>
Date:   Sun Nov 9 22:47:58 2014 +0800

    iommu/vt-d: Implement DMAR unit hotplug framework
    
    On Intel platforms, an IO Hub (PCI/PCIe host bridge) may contain DMAR
    units, so we need to support DMAR hotplug when supporting PCI host
    bridge hotplug on Intel platforms.
    
    According to Section 8.8 "Remapping Hardware Unit Hot Plug" in "Intel
    Virtualization Technology for Directed IO Architecture Specification
    Rev 2.2", ACPI BIOS should implement ACPI _DSM method under the ACPI
    object for the PCI host bridge to support DMAR hotplug.
    
    This patch introduces interfaces to parse ACPI _DSM method for
    DMAR unit hotplug. It also implements state machines for DMAR unit
    hot-addition and hot-removal.
    
    The PCI host bridge hotplug driver should call dmar_hotplug_hotplug()
    before scanning PCI devices connected for hot-addition and after
    destroying all PCI devices for hot-removal.
    
    Signed-off-by: Jiang Liu <[email protected]>
    Reviewed-by: Yijing Wang <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>

commit 78d8e7046111425bb688cddc4303d79cb0f0d281
Author: Jiang Liu <[email protected]>
Date:   Sun Nov 9 22:47:57 2014 +0800

    iommu/vt-d: Dynamically allocate and free seq_id for DMAR units
    
    Introduce functions to support dynamic IOMMU seq_id allocating and
    releasing, which will be used to support DMAR hotplug.
    
    Also rename IOMMU_UNITS_SUPPORTED as DMAR_UNITS_SUPPORTED.
    
    Signed-off-by: Jiang Liu <[email protected]>
    Reviewed-by: Yijing Wang <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>

commit c2a0b538d2c778aef7bf2fbe7973229192c9a392
Author: Jiang Liu <[email protected]>
Date:   Sun Nov 9 22:47:56 2014 +0800

    iommu/vt-d: Introduce helper function dmar_walk_resources()
    
    Introduce helper function dmar_walk_resources to walk resource entries
    in DMAR table and ACPI buffer object returned by ACPI _DSM method
    for IOMMU hot-plug.
    
    Signed-off-by: Jiang Liu <[email protected]>
    Signed-off-by: Joerg Roedel <[email protected]>

commit eb45fa0b93e03b03848cd048dcc57648409c8125
Author: Jani Nikula <[email protected]>
Date:   Tue Nov 18 12:11:29 2014 +0200

    drm/i915/audio: fix monitor presence indication after disable
    
    Indicate the monitor has been disconnected on disable.
    
    The regression has been introduced in
    
    commit 5fad84a7530f8e7664cdc6f490cb90653fed1266
    Author: Jani Nikula <[email protected]>
    Date:   Tue Nov 4 10:30:23 2014 +0200
    
        drm/i915: rewrite hsw/bdw audio codec enable/disable sequences
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=86424
    Cc: Rodrigo Vivi <[email protected]>
    Signed-off-by: Jani Nikula <[email protected]>
    Signed-off-by: Daniel Vetter <[email protected]>

commit 6676f3081f7e3dae64e05b87d47a041b782f898a
Author: Hui Wang <[email protected]>
Date:   Tue Nov 18 17:57:41 2014 +0800

    ALSA: hda - fix the mic mute led problem for Latitude E5550
    
    The microphone mute led on the Latitude E5550 can't work. We need to
    apply DELL_WMI_MIC_MUTE_LED quirk to this machine.
    
    The machine uses alc293 codec and already applied the quirk
    ALC293_FIXUP_DELL1_MIC_NO_PRESENCE through pin_fixup_tbl[].
    
    Here we just let DELL_WMI_MIC_MUTE_LED be chained to
    ALC269_FIXUP_HEADSET_MODE, then the machine will have these
    quirks ALC293_FIXUP_DELL1_MIC_NO_PRESENCE-->
    ALC269_FIXUP_HEADSET_MODE-->ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED.
    
    BugLink: https://bugs.launchpad.net/bugs/1381856
    Reported-and-tested-by: Po-Hsu Lin <[email protected]>
    Signed-off-by: Hui Wang <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>

commit 4a83d42ae2041d5b76f1a0662bc3a5a85e4eb0d1
Author: Hui Wang <[email protected]>
Date:   Tue Nov 18 17:57:40 2014 +0800

    ALSA: hda - move DELL_WMI_MIC_MUTE_LED to the tail in the quirk chain
    
    We have one more Dell machine needs DELL_WMI_MIC_MUTE_LED quirk, but
    the machine uses alc293 instead of alc255. So if
    DELL_WMI_MIC_MUTE_LED still chain ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
    the machine can't use this quirk.
    
    To change this situation, let the DELL_WMI_MIC_MUTE_LED to be a
    standalone quirk, and let other quirks chain it.
    
    After this change, this quirk can be chained to any existing quirks,
    and as a result, it is possible that this quirk is applied to
    a non-Dell machine or a Dell machine without mic mute led on it, but
    it is still safe since alc_fixup_dell_wmi() will return an error in
    these situations.
    
    And remove the quirk for machine with subsystem id 0x6010 and 0x601f,
    these two machines will fall back to the quirk
    ALC255_FIXUP_DELL1_MIC_NO_PRESENCE-->ALC255_FIXUP_HEADSET_MODE-->
    ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED through pin_fixup_tbl[].
    
    BugLink: https://bugs.launchpad.net/bugs/1381856
    Reported-and-tested-by: Po-Hsu Lin <[email protected]>
    Signed-off-by: Hui Wang <[email protected]>
    Signed-off-by: Takashi Iwai <[email protected]>

commit 3ffa037d7f78ceb25115eda29176c2bd2844866f
Author: Neerav Parikh <[email protected]>
Date:   Wed Nov 12 00:19:02 2014 +0000

    i40e: Set XPS bit mask to zero in DCB mode
    
    Due to DCBX configuration change if the VSI needs to use more than 1 TC;
    it needs to disable the XPS maps that were set when operating in 1 TC mode.
    Without disabling XPS the netdev layer will select queues based on those
    settings and not use the TC queue mapping to make the queue selection.
    
    This patch allows the driver to enable/disable the XPS based on the number
    of TCs being enabled for the given VSI.
    
    Change-ID: Idc4dec47a672d2a509f6d7fe11ed1ee65b4f0e08
    Signed-off-by: Neerav Parikh <[email protected]>
    Tested-By: Jack Morgan <[email protected]>
    Signed-off-by: Jeff Kirsher <[email protected]>

commit 4b7698cb95638693e3d9a2fc01a2bdbd8710ff81
Author: Neerav Parikh <[email protected]>
Date:   Wed Nov 12 00:18:57 2014 +0000

    i40e: Prevent link flow control settings when PFC is enabled
    
    When PFC is enabled we should not proceed with setting the link flow control
    parameters.  Also, always report the link flow Tx/Rx settings as off when
    PFC is enabled.
    
    Change-ID: Ib09ec58afdf0b2e587ac9d8851a5c80ad58206c4
    Signed-off-by: Neerav Parikh <[email protected]>
    Tested-By: Jack Morgan <[email protected]>
    Signed-off-by: Jeff Kirsher <[email protected]>

commit d341b7a52be79520f8e8b1ed0e3df657b2442e5b
Author: Neerav Parikh <[email protected]>
Date:   Wed Nov 12 00:18:51 2014 +0000

    i40e: Do not disable/enable FCoE VSI with DCB reconfig
    
    FCoE VSI Tx queue disable times out when reconfiguring as a result of
    DCB TC configuration change event.
    
    The hardware allows us to skip disabling and enabling of Tx queues for
    VSIs with single TC enabled. As FCoE VSI is configured to have only
    single TC we skip it from disable/enable flow.
    
    Change-ID: Ia73ff3df8785ba2aa3db91e6f2c9005e61ebaec2
    Signed-off-by: Neerav Parikh <[email protected]>
    Tested-By: Jack Morgan <[email protected]>
    Signed-off-by: Jeff Kirsher <[email protected]>

commit 69129dc39fac45e0ea1dbbca995abdac279df376
Author: Neerav Parikh <[email protected]>
Date:   Wed Nov 12 00:18:46 2014 +0000

    i40e: Modify Tx disable wait flow in case of DCB reconfiguration
    
    When DCB TC configuration changes the firmware suspends the port's Tx.
    Now, as DCB TCs may have changed the PF driver tries to reconfigure the
    TC configuration of the VSIs it manages. As part of this process it disables
    the VSI queues but the Tx queue disable will not complete as the port's
    Tx has been suspended. So, waiting for Tx queues to go to disable state
    in this flow may lead to detection of Tx queue disable timeout errors.
    
    Hence, this patch adds a new PF state so that if a port's Tx is in
    suspended state the Tx queue disable flow would just put the request for
    the queue to be disabled and return without waiting for the queue to be
    actually disabled.
    Once the VSI(s) TC reconfiguration has been done and driver has called
    firmware AQC "Resume PF Traffic" the driver checks the Tx queues requested
    to be disabled are actually disabled before re-enabling them again.
    
    Change-ID: If3e03ce4813a4e342dbd5a1eb1d2861e952b7544
    Signed-off-by: Neerav Parikh <[email protected]>
    Tested-By: Jack Morgan <[email protected]>
    Signed-off-by: Jeff Kirsher <[email protected]>

commit 23cd1f095adf110d118ef972914c714176cd48d0
Author: Neerav Parikh <[email protected]>
Date:   Wed Nov 12 00:18:41 2014 +0000

    i40e: Update VEB's enabled_tc after reconfiguration
    
    When the port TC configuration changes as a result of DCBx the driver
    modifies the enabled TCs for the VEBs it manages. But, in the process
    it did not update the enabled_tc value that it caches on a per VEB basis.
    
    So, when the next reconfiguration event occurs where the number of TC
    value is same as the value cached in enabled_tc for a given VEB; driver
    does not modify it's TC configuration by calling appropriate AQ command
    believing it is running with the same configuration as requested.
    Now, as the VEB is not actually enabled for the TCs that are there any
    TC configuration command for VSI attached to that VEB with TCs that are
    not enabled for the VEB fails.
    
    This patch fixes this issue.
    
    Change-ID: Ife5694469b05494228e0d850429ea1734738cf29
    Signed-off-by: Neerav Parikh <[email protected]>
    Tested-By: Jack Morgan <[email protected]>
    Signed-off-by: Jeff Kirsher <[email protected]>

commit e1c4751ee22f5d5f6f6cfcb70614e18e4218892e
Author: Neerav Parikh <[email protected]>
Date:   Wed Nov 12 00:18:30 2014 +0000

    i40e: Check for LLDP AdminStatus before querying DCBX
    
    This patch adds a check whether LLDP Agent's default AdminStatus is
    enabled or disabled on a given port. If it is disabled then it sets
    the DCBX status to disabled as well; and would not query firmware for
    any DCBX configuration data.
    
    Change-ID: I73c0b9f0adbf4cae177d14914b20a48c9a8f50fd
    Signed-off-by: Neerav Parikh <[email protected]>
    Tested-By: Jack Morgan <[email protected]>
    Signed-off-by: Jeff Kirsher <[email protected]>

commit 9fa61dd2153a4ff3a57891d4866a2595eb9ac81a
Author: Neerav Parikh <[email protected]>
Date:   Wed Nov 12 00:18:25 2014 +0000

    i40e: Add support to firmware CEE DCBX mode
    
    This patch allows i40e driver to query and use DCB configuration from
    firmware when firmware DCBX agent is in CEE mode.
    
    Change-ID: I30f92a67eb890f0f024f35339696e6e83d49a274
    Signed-off-by: Neerav Parikh <[email protected]>
    Tested-By: Jack Morgan <[email protected]>
    Signed-off-by: Jeff Kirsher <[email protected]>

commit 2fd75f31f6bacaed38061f95f0fee26de3e01170
Author: Neerav Parikh <[email protected]>
Date:   Wed Nov 12 00:18:20 2014 +0000

    i40e: Resume Port Tx after DCB event
    
    When there are DCB configuration changes based on DCBX the firmware suspends
    the port's Tx and generates an event to the PF. The PF is then responsible
    to reconfigure the PF VSIs and switching topology as per the updated DCB
    configuration and then resume the port's Tx by calling the "Resume Port Tx"
    AQ command.
    
    This patch adds this call to the flow that handles DCB re-configuration in
    the PF.
    
    Change-ID: I5b860ad48abfbf379b003143c4d3453e2ed5cc1c
    Signed-off-by: Neerav Parikh <[email protected]>
    Tested-By: Jack Morgan <[email protected]>
    Signed-off-by: Jeff Kirsher <[email protected]>

commit 7bda87c7fb2eaab8e144d6d0a2638099d7b6e5f5
Author: Catherine Sullivan <[email protected]>
Date:   Tue Nov 11 03:15:06 2014 +0000

    i40e: Bump version to 1.1.23
    
    Bumping minor version as this will be the second SW release and it
    should be 1.
    
    Change-ID: If0bd102095d2f059ae0c9b7f4ad625535ffbbdee
    Signed-off-by: Catherine Sullivan <[email protected]>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirshe…
aryabinin pushed a commit to aryabinin/linux that referenced this pull request Nov 27, 2014
@hnaz
origin
fa19cdc 
GIT b914c5b

commit 31345e1
Author: Benjamin Herrenschmidt <[email protected]>
Date:   Tue Oct 7 16:13:34 2014 +1100

    powerpc/pci: Remove unused force_32bit_msi quirk
    
    This is now fully replaced with the generic "no_64bit_msi" one
    that is set by the respective drivers directly.
    
    Signed-off-by: Benjamin Herrenschmidt <[email protected]>

commit 415072a
Author: Benjamin Herrenschmidt <[email protected]>
Date:   Tue Oct 7 16:12:55 2014 +1100

    powerpc/pseries: Honor the generic "no_64bit_msi" flag
    
    Instead of the arch specific quirk which we are deprecating
    
    Signed-off-by: Benjamin Herrenschmidt <[email protected]>
    CC: <[email protected]>

commit 3607438
Author: Benjamin Herrenschmidt <[email protected]>
Date:   Tue Oct 7 16:12:36 2014 +1100

    powerpc/powernv: Honor the generic "no_64bit_msi" flag
    
    Instead of the arch specific quirk which we are deprecating
    and that drivers don't understand.
    
    Signed-off-by: Benjamin Herrenschmidt <[email protected]>
    CC: <[email protected]>

commit db79afa
Author: Benjamin Herrenschmidt <[email protected]>
Date:   Mon Nov 24 14:17:08 2014 +1100

    sound/radeon: Move 64-bit MSI quirk from arch to driver
    
    A number of radeon cards have a HW limitation causing them to be
    unable to generate the full 64-bit of address bits for MSIs. This
    breaks MSIs on some platforms such as POWER machines.
    
    We used to have a powerpc specific quirk to address that on a
    single card, but this doesn't scale very well, this is better
    put under control of the drivers who know precisely what a given
    HW revision can do.
    
    We now have a generic quirk in the PCI code. We should set it
    appropriately for all radeon's from the audio driver.
    
    Signed-off-by: Benjamin Herrenschmidt <[email protected]>
    Reviewed-by: Takashi Iwai <[email protected]>
    Reviewed-by: Alex Deucher <[email protected]>
    CC: <[email protected]>

commit 91ed6fd
Author: Benjamin Herrenschmidt <[email protected]>
Date:   Fri Oct 3 15:18:59 2014 +1000

    gpu/radeon: Set flag to indicate broken 64-bit MSI
    
    Some radeon ASICs don't support all 64 address bits of MSIs despite
    advertising support for 64-bit MSIs in their configuration space.
    
    This breaks on systems such as IBM POWER7/8, where 64-bit MSIs can
    be assigned with some of the high address bits set.
    
    This makes use of the newly introduced "no_64bit_msi" flag in structure
    pci_dev to allow the MSI allocation code to fallback to 32-bit MSIs
    on those adapters.
    
    Signed-off-by: Benjamin Herrenschmidt <[email protected]>
    Reviewed-by: Alex Deucher <[email protected]>
    CC: <[email protected]>
    ---
    
    Adding Alex's review tag. Patch to the driver is identical to the
    reviewed one, I dropped the arch/powerpc hunk rewrote the subject
    and cset comment.

commit f144d14
Author: Benjamin Herrenschmidt <[email protected]>
Date:   Fri Oct 3 15:13:24 2014 +1000

    PCI/MSI: Add device flag indicating that 64-bit MSIs don't work
    
    This can be set by quirks/drivers to be used by the architecture code
    that assigns the MSI addresses.
    
    We additionally add verification in the core MSI code that the values
    assigned by the architecture do satisfy the limitation in order to fail
    gracefully if they don't (ie. the arch hasn't been updated to deal with
    that quirk yet).
    
    Signed-off-by: Benjamin Herrenschmidt <[email protected]>
    CC: <[email protected]>
    Acked-by: Bjorn Helgaas <[email protected]>

commit 413cbf4
Author: Takashi Iwai <[email protected]>
Date:   Wed Oct 1 10:30:53 2014 +0200

    ALSA: hda - Limit 40bit DMA for AMD HDMI controllers
    
    AMD/ATI HDMI controller chip models, we already have a filter to lower
    to 32bit DMA, but the rest are supposed to be working with 64bit
    although the hardware doesn't really work with 63bit but only with 40
    or 48bit DMA.  In this patch, we take 40bit DMA for safety for the
    AMD/ATI controllers as the graphics drivers does.
    
    Signed-off-by: Takashi Iwai <[email protected]>
    Signed-off-by: Benjamin Herrenschmidt <[email protected]>
    CC: <[email protected]>

commit 6b19b66
Author: Arnaud Ebalard <[email protected]>
Date:   Wed Nov 19 22:52:36 2014 +0100

    hwmon: (g762) fix call to devm_hwmon_device_register_with_groups()
    
    g762_remove() needs to first call hwmon_device_unregister() and then
    g762_of_clock_disable(). For that reason, it is not possible to
    convert it to devm_hwmon_device_register_with_groups() and the
    the non device managed version must be used.
    
    This is correctly stated in commit message for 398e16d ("hwmon:
    (g762) Convert to hwmon_device_register_with_groups") but the
    associated changes do in fact introduce a call to the device managed
    version of the function.
    
    This patch fixes that typo by switching to the non devm_ version.
    
    Fixes: 398e16d ("hwmon: (g762) Convert to hwmon_device_register_with_groups")
    Cc: [email protected] (3.17+)
    Signed-off-by: Arnaud Ebalard <[email protected]>
    Signed-off-by: Guenter Roeck <[email protected]>

commit c6c15e1
Author: Trond Myklebust <[email protected]>
Date:   Wed Nov 19 12:47:50 2014 -0500

    nfsd: Fix slot wake up race in the nfsv4.1 callback code
    
    The currect code for nfsd41_cb_get_slot() and nfsd4_cb_done() has no
    locking in order to guarantee atomicity, and so allows for races of
    the form.
    
    Task 1                                  Task 2
    ======                                  ======
    if (test_and_set_bit(0) != 0) {
                                            clear_bit(0)
                                            rpc_wake_up_next(queue)
            rpc_sleep_on(queue)
            return false;
    }
    
    This patch breaks the race condition by adding a retest of the bit
    after the call to rpc_sleep_on().
    
    Signed-off-by: Trond Myklebust <[email protected]>
    Cc: [email protected]
    Signed-off-by: J. Bruce Fields <[email protected]>

commit 093a146
Author: Trond Myklebust <[email protected]>
Date:   Wed Nov 12 18:04:04 2014 -0500

    SUNRPC: Fix locking around callback channel reply receive
    
    Both xprt_lookup_rqst() and xprt_complete_rqst() require that you
    take the transport lock in order to avoid races with xprt_transmit().
    
    Signed-off-by: Trond Myklebust <[email protected]>
    Cc: [email protected]
    Reviewed-by: Jeff Layton <[email protected]>
    Signed-off-by: J. Bruce Fields <[email protected]>

commit 6d0ba04
Author: Christoph Hellwig <[email protected]>
Date:   Sat Nov 8 13:11:03 2014 +0100

    nfsd: correctly define v4.2 support attributes
    
    Even when security labels are disabled we support at least the same
    attributes as v4.1.
    
    Signed-off-by: Christoph Hellwig <[email protected]>
    Cc: [email protected]
    Signed-off-by: J. Bruce Fields <[email protected]>

commit dcf3d45
Author: Robert Jarzmik <[email protected]>
Date:   Tue Oct 7 01:07:57 2014 +0200

    clk: pxa: fix pxa27x CCCR bit usage
    
    Trivial fix to check the A bit of CCCR for memory frequency
    calculations, where the shift of the bit index was missing, triggering a
    wrong calculation of memory frequency.
    
    Signed-off-by: Robert Jarzmik <[email protected]>
    Signed-off-by: Michael Turquette <[email protected]>

commit e6d5e7d
Author: James Hogan <[email protected]>
Date:   Fri Nov 14 15:32:09 2014 +0000

    clk-divider: Fix READ_ONLY when divider > 1
    
    Commit 79c6ab5 (clk: divider: add CLK_DIVIDER_READ_ONLY flag) in
    v3.16 introduced the CLK_DIVIDER_READ_ONLY flag which caused the
    recalc_rate() and round_rate() clock callbacks to be omitted.
    
    However using this flag has the unfortunate side effect of causing the
    clock recalculation code when a clock rate change is attempted to always
    treat it as a pass-through clock, i.e. with a fixed divide of 1, which
    may not be the case. Child clock rates are then recalculated using the
    wrong parent rate.
    
    Therefore instead of dropping the recalc_rate() and round_rate()
    callbacks, alter clk_divider_bestdiv() to always report the current
    divider as the best divider so that it is never altered.
    
    For me the read only clock was the system clock, which divided the PLL
    rate by 2, from which both the UART and the SPI clocks were divided.
    Initial setting of the UART rate set it correctly, but when the SPI
    clock was set, the other child clocks were miscalculated. The UART clock
    was recalculated using the PLL rate as the parent rate, resulting in a
    UART new_rate of double what it should be, and a UART which spewed forth
    garbage when the rate changes were propagated.
    
    Signed-off-by: James Hogan <[email protected]>
    Cc: Thomas Abraham <[email protected]>
    Cc: Tomasz Figa <[email protected]>
    Cc: Max Schwarz <[email protected]>
    Cc: <[email protected]> # v3.16+
    Acked-by: Haojian Zhuang <[email protected]>
    Signed-off-by: Michael Turquette <[email protected]>

commit 9a6cb70
Author: Georgi Djakov <[email protected]>
Date:   Fri Oct 10 16:57:24 2014 +0300

    clk: qcom: Fix duplicate rbcpr clock name
    
    There is a duplication in a clock name for apq8084 platform that causes
    the following warning: "RBCPR_CLK_SRC" redefined
    
    Resolve this by adding a MMSS_ prefix to this clock and making its name
    coherent with msm8974 platform.
    
    Fixes: 2b46cd2 ("clk: qcom: Add APQ8084 Multimedia Clock Controller (MMCC) support")
    Signed-off-by: Georgi Djakov <[email protected]>
    Reviewed-by: Stephen Boyd <[email protected]>
    Signed-off-by: Michael Turquette <[email protected]>

commit 69daf75
Author: Boris Brezillon <[email protected]>
Date:   Mon Nov 17 14:16:56 2014 +0100

    clk: at91: usb: fix at91sam9x5 recalc, round and set rate
    
    First check for rate == 0 in set_rate and round_rate to avoid div by zero.
    Then, in order to get the closest rate, round all divisions to the closest
    result instead of rounding them down.
    
    Signed-off-by: Boris Brezillon <[email protected]>
    Acked-by: Nicolas Ferre <[email protected]>
    Signed-off-by: Michael Turquette <[email protected]>

commit ff553ea
Author: Boris Brezillon <[email protected]>
Date:   Fri Nov 14 19:54:49 2014 +0100

    clk: at91: usb: fix at91rm9200 round and set rate
    
    at91rm9200_clk_usb_set_rate might fail depending on the requested rate,
    because the parent_rate / rate remainder is not necessarily zero.
    Moreover, when rounding down the calculated rate we might alter the
    divisor calculation and end up with an invalid divisor.
    
    To solve those problems, accept a non zero remainder, and always round
    division to the closest result.
    
    Signed-off-by: Boris Brezillon <[email protected]>
    Reported-by: Andreas Henriksson <[email protected]>
    Tested-by: Andreas Henriksson <[email protected]>
    Acked-by: Nicolas Ferre <[email protected]>
    Signed-off-by: Michael Turquette <[email protected]>

commit 835f252
Author: Gu Zheng <[email protected]>
Date:   Thu Nov 6 17:46:21 2014 +0800

    aio: fix uncorrent dirty pages accouting when truncating AIO ring buffer
    
    https://bugzilla.kernel.org/show_bug.cgi?id=86831
    
    Markus reported that when shutting down mysqld (with AIO support,
    on a ext3 formatted Harddrive) leads to a negative number of dirty pages
    (underrun to the counter). The negative number results in a drastic reduction
    of the write performance because the page cache is not used, because the kernel
    thinks it is still 2 ^ 32 dirty pages open.
    
    Add a warn trace in __dec_zone_state will catch this easily:
    
    static inline void __dec_zone_state(struct zone *zone, enum
    	zone_stat_item item)
    {
         atomic_long_dec(&zone->vm_stat[item]);
    +    WARN_ON_ONCE(item == NR_FILE_DIRTY &&
    	atomic_long_read(&zone->vm_stat[item]) < 0);
         atomic_long_dec(&vm_stat[item]);
    }
    
    [   21.341632] ------------[ cut here ]------------
    [   21.346294] WARNING: CPU: 0 PID: 309 at include/linux/vmstat.h:242
    cancel_dirty_page+0x164/0x224()
    [   21.355296] Modules linked in: wutbox_cp sata_mv
    [   21.359968] CPU: 0 PID: 309 Comm: kworker/0:1 Not tainted 3.14.21-WuT torvalds#80
    [   21.366793] Workqueue: events free_ioctx
    [   21.370760] [<c0016a64>] (unwind_backtrace) from [<c0012f88>]
    (show_stack+0x20/0x24)
    [   21.378562] [<c0012f88>] (show_stack) from [<c03f8ccc>]
    (dump_stack+0x24/0x28)
    [   21.385840] [<c03f8ccc>] (dump_stack) from [<c0023ae4>]
    (warn_slowpath_common+0x84/0x9c)
    [   21.393976] [<c0023ae4>] (warn_slowpath_common) from [<c0023bb8>]
    (warn_slowpath_null+0x2c/0x34)
    [   21.402800] [<c0023bb8>] (warn_slowpath_null) from [<c00c0688>]
    (cancel_dirty_page+0x164/0x224)
    [   21.411524] [<c00c0688>] (cancel_dirty_page) from [<c00c080c>]
    (truncate_inode_page+0x8c/0x158)
    [   21.420272] [<c00c080c>] (truncate_inode_page) from [<c00c0a94>]
    (truncate_inode_pages_range+0x11c/0x53c)
    [   21.429890] [<c00c0a94>] (truncate_inode_pages_range) from
    [<c00c0f6c>] (truncate_pagecache+0x88/0xac)
    [   21.439252] [<c00c0f6c>] (truncate_pagecache) from [<c00c0fec>]
    (truncate_setsize+0x5c/0x74)
    [   21.447731] [<c00c0fec>] (truncate_setsize) from [<c013b3a8>]
    (put_aio_ring_file.isra.14+0x34/0x90)
    [   21.456826] [<c013b3a8>] (put_aio_ring_file.isra.14) from
    [<c013b424>] (aio_free_ring+0x20/0xcc)
    [   21.465660] [<c013b424>] (aio_free_ring) from [<c013b4f4>]
    (free_ioctx+0x24/0x44)
    [   21.473190] [<c013b4f4>] (free_ioctx) from [<c003d8d8>]
    (process_one_work+0x134/0x47c)
    [   21.481132] [<c003d8d8>] (process_one_work) from [<c003e988>]
    (worker_thread+0x130/0x414)
    [   21.489350] [<c003e988>] (worker_thread) from [<c00448ac>]
    (kthread+0xd4/0xec)
    [   21.496621] [<c00448ac>] (kthread) from [<c000ec18>]
    (ret_from_fork+0x14/0x20)
    [   21.503884] ---[ end trace 79c4bf42c038c9a1 ]---
    
    The cause is that we set the aio ring file pages as *DIRTY* via SetPageDirty
    (bypasses the VFS dirty pages increment) when init, and aio fs uses
    *default_backing_dev_info* as the backing dev, which does not disable
    the dirty pages accounting capability.
    So truncating aio ring file will contribute to accounting dirty pages (VFS
    dirty pages decrement), then error occurs.
    
    The original goal is keeping these pages in memory (can not be reclaimed
    or swapped) in life-time via marking it dirty. But thinking more, we have
    already pinned pages via elevating the page's refcount, which can already
    achieve the goal, so the SetPageDirty seems unnecessary.
    
    In order to fix the issue, using the __set_page_dirty_no_writeback instead
    of the nop .set_page_dirty, and dropped the SetPageDirty (don't manually
    set the dirty flags, don't disable set_page_dirty(), rely on default behaviour).
    
    With the above change, the dirty pages accounting can work well. But as we
    known, aio fs is an anonymous one, which should never cause any real write-back,
    we can ignore the dirty pages (write back) accounting by disabling the dirty
    pages (write back) accounting capability. So we introduce an aio private
    backing dev info (disabled the ACCT_DIRTY/WRITEBACK/ACCT_WB capabilities) to
    replace the default one.
    
    Reported-by: Markus Königshaus <[email protected]>
    Signed-off-by: Gu Zheng <[email protected]>
    Cc: stable <[email protected]>
    Acked-by: Andrew Morton <[email protected]>
    Signed-off-by: Benjamin LaHaise <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
aryabinin referenced this pull request in aryabinin/linux Nov 27, 2014
@hnaz
linux-next
957dd97 
GIT 30a727e4802f48182d33e2bdaca586bfb6a62868

commit 6d4e81ed89c092cb156c8d19cb68c8733cd502b3
Author: Tomeu Vizoso <[email protected]>
Date:   Mon Nov 24 10:08:03 2014 +0100

    cpufreq: Ref the policy object sooner
    
    Do it before it's assigned to cpufreq_cpu_data, otherwise when a driver
    tries to get the cpu frequency during initialization the policy kobj is
    referenced and we get this warning:
    
    ------------[ cut here ]------------
    WARNING: CPU: 1 PID: 64 at include/linux/kref.h:47 kobject_get+0x64/0x70()
    Modules linked in:
    CPU: 1 PID: 64 Comm: irq/77-tegra-ac Not tainted 3.18.0-rc4-next-20141114ccu-00050-g3eff942 #326
    [<c0016fac>] (unwind_backtrace) from [<c001272c>] (show_stack+0x10/0x14)
    [<c001272c>] (show_stack) from [<c06085d8>] (dump_stack+0x98/0xd8)
    [<c06085d8>] (dump_stack) from [<c002892c>] (warn_slowpath_common+0x84/0xb4)
    [<c002892c>] (warn_slowpath_common) from [<c00289f8>] (warn_slowpath_null+0x1c/0x24)
    [<c00289f8>] (warn_slowpath_null) from [<c0220290>] (kobject_get+0x64/0x70)
    [<c0220290>] (kobject_get) from [<c03e944c>] (cpufreq_cpu_get+0x88/0xc8)
    [<c03e944c>] (cpufreq_cpu_get) from [<c03e9500>] (cpufreq_get+0xc/0x64)
    [<c03e9500>] (cpufreq_get) from [<c0285288>] (actmon_thread_isr+0x134/0x198)
    [<c0285288>] (actmon_thread_isr) from [<c0069008>] (irq_thread_fn+0x1c/0x40)
    [<c0069008>] (irq_thread_fn) from [<c0069324>] (irq_thread+0x134/0x174)
    [<c0069324>] (irq_thread) from [<c0040290>] (kthread+0xdc/0xf4)
    [<c0040290>] (kthread) from [<c000f4b8>] (ret_from_fork+0x14/0x3c)
    ---[ end trace b7bd64a81b340c59 ]---
    
    Signed-off-by: Tomeu Vizoso <[email protected]>
    Acked-by: Viresh Kumar <[email protected]>
    Signed-off-by: Rafael J. Wysocki <[email protected]>

commit e874bf5f7647a9fdf14d72dbb376ec95327e3a81
Author: Lars-Peter Clausen <[email protected]>
Date:   Tue Nov 25 21:41:03 2014 +0100

    ASoC: Disable regmap helpers if regmap is disabled
    
    If regmap is disabled there will be no users of the ASoC regmap helpers.
    Furthermore regmap_exit() will no be defined causing the following compile
    error:
    	sound/soc/soc-core.c: In function 'snd_soc_component_exit_regmap':
    	sound/soc/soc-core.c:2645:2: error: implicit declaration of function
    		'regmap_exit' [-Werror=implicit-function-declaration]
    
    So disable the helpers if regmap is disabled.
    
    Reported-by: kbuild test robot <[email protected]>
    Fixes: 20feb881988c ASoC: Add helper functions for deferred regmap setup")
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit a5e9ab291c608c62691b9d565104a30d931998bf
Author: Greg Kroah-Hartman <[email protected]>
Date:   Tue Nov 25 12:46:39 2014 -0800

    Revert "serial: of-serial: add PM suspend/resume support"
    
    This reverts commit 2dea53bf57783f243c892e99c10c6921e956aa7e.
    
    Turns out to be broken :(
    
    Cc: Jingchang Lu <[email protected]>
    Cc: Arnd Bergmann <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 86261fdd65ce076c0aa05dbf3f5f5fe10aab1bcf
Author: Petr Cvek <[email protected]>
Date:   Tue Nov 25 06:05:33 2014 +0100

    i2c: pxa: add support for SCCB devices
    
    Add support for SCCB by implementing I2C_M_IGNORE_NAK and I2C_M_STOP
    flags and advertising functionality flag I2C_FUNC_PROTOCOL_MANGLING.
    
    Also fixed missing functionality flag I2C_FUNC_NOSTART.
    
    Signed-off-by: Petr Cvek <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit 23173eae7b9a5389d3f7031b77cde34f63b814a2
Author: Alexander Kochetkov <[email protected]>
Date:   Tue Nov 25 02:20:55 2014 +0400

    omap: i2c: don't check bus state IP rev3.3 and earlier
    
    Commit 0f5768bf894f ("i2c: omap: implement workaround for handling
    invalid BB-bit values") introduce the error result in boot test fault on
    OMAP3530 boards.
    
    The patch fix the error (disable i2c bus test for OMAP3530).
    
    Reported-by: Kevin Hilman <[email protected]>
    Signed-off-by: Alexander Kochetkov <[email protected]>
    Fixes: 0f5768bf894f ("i2c: omap: implement workaround for handling invalid BB-bit values")
    Tested-by: Tony Lindgren <[email protected]>
    Tested-by: Kevin Hilman <[email protected]>
    Signed-off-by: Wolfram Sang <[email protected]>

commit a620a6bc1c94c22d6c312892be1e0ae171523125
Author: Thadeu Lima de Souza Cascardo <[email protected]>
Date:   Tue Nov 25 14:21:11 2014 -0200

    tg3: fix ring init when there are more TX than RX channels
    
    If TX channels are set to 4 and RX channels are set to less than 4,
    using ethtool -L, the driver will try to initialize more RX channels
    than it has allocated, causing an oops.
    
    This fix only initializes the RX ring if it has been allocated.
    
    Signed-off-by: Thadeu Lima de Souza Cascardo <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 69b93607a9862b1db2f0f2e078e1396f8e20fa9b
Author: Lars-Peter Clausen <[email protected]>
Date:   Tue Nov 25 20:29:40 2014 +0100

    ASoC: qi_lb60: Pass flags to gpiod_get()
    
    Pass flags to gpiod_get() to automatically configure the GPIOs. This is shorter
    and not passing any flags to gpiod_get() will eventually no longer be supported.
    
    Signed-off-by: Lars-Peter Clausen <[email protected]>
    Signed-off-by: Mark Brown <[email protected]>

commit c3658e8d0f10147fc86018be7f11668246c156d3
Author: Eric Dumazet <[email protected]>
Date:   Tue Nov 25 07:40:04 2014 -0800

    tcp: fix possible NULL dereference in tcp_vX_send_reset()
    
    After commit ca777eff51f7 ("tcp: remove dst refcount false sharing for
    prequeue mode") we have to relax check against skb dst in
    tcp_v[46]_send_reset() if prequeue dropped the dst.
    
    If a socket is provided, a full lookup was done to find this socket,
    so the dst test can be skipped.
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=88191
    Reported-by: Jaša Bartelj <[email protected]>
    Signed-off-by: Eric Dumazet <[email protected]>
    Reported-by: Daniel Borkmann <[email protected]>
    Fixes: ca777eff51f7 ("tcp: remove dst refcount false sharing for prequeue mode")
    Signed-off-by: David S. Miller <[email protected]>

commit 7d63a5f9b25ba6b130da8eb2d32a72b1462d0249
Author: Larry Finger <[email protected]>
Date:   Tue Nov 25 10:32:07 2014 -0600

    rtlwifi: Change order in device startup
    
    The existing order of steps when starting the PCI devices works for
    2.4G devices, but fails to initialize the 5G section of the RTL8821AE
    hardware.
    
    This patch is needed to fix the regression reported in Bug #88811
    (https://bugzilla.kernel.org/show_bug.cgi?id=88811).
    
    Reported-by: Valerio Passini <[email protected]>
    Tested-by: Valerio Passini <[email protected]>
    Signed-off-by: Larry Finger <[email protected]>
    Cc: Valerio Passini <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit a91ed1901a80b401afa1b718d941d3450d868151
Author: Larry Finger <[email protected]>
Date:   Tue Nov 25 10:32:06 2014 -0600

    rtlwifi: rtl8821ae: Fix 5G detection problem
    
    The changes associated with moving this driver from staging to the regular
    tree missed one section setting the allowable rates for the 5GHz band.
    
    This patch is needed to fix the regression reported in Bug #88811
    (https://bugzilla.kernel.org/show_bug.cgi?id=88811).
    
    Reported-by: Valerio Passini <[email protected]>
    Tested-by: Valerio Passini <[email protected]>
    Signed-off-by: Larry Finger <[email protected]>
    Cc: Valerio Passini <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 43612d7c04f1a4f5e60104143918fcdf018b66ee
Author: Pablo Neira <[email protected]>
Date:   Tue Nov 25 19:54:47 2014 +0100

    Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse"
    
    This reverts commit 5195c14c8b27cc0b18220ddbf0e5ad3328a04187.
    
    If the conntrack clashes with an existing one, it is left out of
    the unconfirmed list, thus, crashing when dropping the packet and
    releasing the conntrack since golden rule is that conntracks are
    always placed in any of the existing lists for traceability reasons.
    
    Reported-by: Daniel Borkmann <[email protected]>
    Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=88841
    Signed-off-by: Pablo Neira Ayuso <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 3dc2b6a8d38cf6c7604ec25f3d50d6ec8da04435
Author: Alexander Duyck <[email protected]>
Date:   Mon Nov 24 20:08:38 2014 -0800

    vxlan: Fix boolean flip in VXLAN_F_UDP_ZERO_CSUM6_[TX|RX]
    
    In "vxlan: Call udp_sock_create" there was a logic error that resulted in
    the default for IPv6 VXLAN tunnels going from using checksums to not using
    checksums.  Since there is currently no support in iproute2 for setting
    these values it means that a kernel after the change cannot talk over a IPv6
    VXLAN tunnel to a kernel prior the change.
    
    Fixes: 3ee64f3 ("vxlan: Call udp_sock_create")
    
    Cc: Tom Herbert <[email protected]>
    Signed-off-by: Alexander Duyck <[email protected]>
    Acked-by: Tom Herbert <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit f3750817a9034bd8cbb5ba583cd544e7cf14c7d8
Author: Alexander Duyck <[email protected]>
Date:   Mon Nov 24 20:08:32 2014 -0800

    ip6_udp_tunnel: Fix checksum calculation
    
    The UDP checksum calculation for VXLAN tunnels is currently using the
    socket addresses instead of the actual packet source and destination
    addresses.  As a result the checksum calculated is incorrect in some
    cases.
    
    Also uh->check was being set twice, first it was set to 0, and then it is
    set again in udp6_set_csum.  This change removes the redundant assignment
    to 0.
    
    Fixes: acbf74a7 ("vxlan: Refactor vxlan driver to make use of the common UDP tunnel functions.")
    
    Cc: Andy Zhou <[email protected]>
    Signed-off-by: Alexander Duyck <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 18ca43823f3ce111c6efb8cc90d9f35246527727
Author: Amitkumar Karwar <[email protected]>
Date:   Tue Nov 25 06:43:06 2014 -0800

    mwifiex: add Tx status support for ACTION frames
    
    ACK status (0/1) for ACTION frames is informed to cfg80211. We
    will extend existing logic used for EAPOL frames. The cfg80211
    API is different here. Also, we need to explicitly free cloned
    skb.
    
    Signed-off-by: Cathy Luo <[email protected]>
    Signed-off-by: Avinash Patil <[email protected]>
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 808bbebcc8fcbcb2b93aefd8b181a0fdccb407c6
Author: Amitkumar Karwar <[email protected]>
Date:   Tue Nov 25 06:43:05 2014 -0800

    mwifiex: add Tx status support for EAPOL packets
    
    Firmware notifies the driver through event if EAPOL data packet
    has been acked or not. We will inform this status to userspace
    listening on a socket.
    
    Signed-off-by: Cathy Luo <[email protected]>
    Signed-off-by: Avinash Patil <[email protected]>
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 381e9fffe6b8343c2479939178ef7ded50bf32d3
Author: Amitkumar Karwar <[email protected]>
Date:   Tue Nov 25 06:43:04 2014 -0800

    mwifiex: skip delay main work logic for USB interface.
    
    We had introduced delay main work logic to avoid processing
    interrupts when Rx pending packet count reaches high threshold.
    interrupt processing is restarted later when packet count
    reduces lower threashold. This helped to reduce unnecessary
    overhead and improve throughput for SD and PCIe chipsets.
    
    As there are no interrupts for USB, we will skip this logic for
    USB chipsets.
    
    Signed-off-by: Cathy Luo <[email protected]>
    Signed-off-by: Avinash Patil <[email protected]>
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 798ea8eec16d33e0553b6be7175a23e8ddf60eee
Author: Amitkumar Karwar <[email protected]>
Date:   Tue Nov 25 06:43:03 2014 -0800

    mwifiex: fix scan problem on big endian platforms
    
    This patch adds missing endian conversion for beacon size while
    processing scan response.
    
    Reported-by: Daniel Mosquera <[email protected]>
    Tested-by: Daniel Mosquera <[email protected]>
    Signed-off-by: Avinash Patil <[email protected]>
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 51974611154038f1aaf6ce843bdc6445d5684ee3
Author: Amitkumar Karwar <[email protected]>
Date:   Tue Nov 25 06:43:02 2014 -0800

    mwifiex: fix sparse warning
    
    This patch fixes following sparse warnings:
    
    drivers/net/wireless/mwifiex/util.c:152:19: warning: cast from restricted __le16
    drivers/net/wireless/mwifiex/util.c:152:19: warning: restricted __le16 degrades to integer
    
    Signed-off-by: Amitkumar Karwar <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 8b537686a116b060475d94b6f548c78289935fef
Author: Lorenzo Bianconi <[email protected]>
Date:   Tue Nov 25 00:21:41 2014 +0100

    ath9k: add TPC capability to TX descriptor path
    
    Add TPC capability to TX descriptor path. Cap per-packet TX power according to
    TX power per-rate tables. Currently TPC is supported just by AR9003 based chips
    
    Signed-off-by: Lorenzo Bianconi <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 23f53dd3062628d2215cab810e4cfc22c29d47ee
Author: Lorenzo Bianconi <[email protected]>
Date:   Tue Nov 25 00:21:40 2014 +0100

    ath9k: add TX power per-rate tables
    
    Add TX power per-rate tables for different MIMO modes (e.g STBC) in order to
    cap the maximum TX power value per-rate in the TX descriptor path.
    Cap TX power for self generated frames (ACK, RTS/CTS).
    Currently TPC is supported just by AR9003 based chips
    
    Signed-off-by: Lorenzo Bianconi <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 4f3fff148679d5850994e53c57eb798cd201c88c
Author: Arend van Spriel <[email protected]>
Date:   Thu Nov 20 22:27:02 2014 +0100

    brcmfmac: correct .disconnect() callback while connecting
    
    When the driver has sent a join iovar to the firmware it waits
    for the events to report result of the connection. However, the
    wpa_supplicant will request a .disconnect() after a timeout. So
    upon calling .disconnect() the interface state may still be
    CONNECTING. Clear the CONNECTING bit as well.
    
    Reviewed-by: Hante Meuleman <[email protected]>
    Reviewed-by: Pieter-Paul Giesberts <[email protected]>
    Signed-off-by: Arend van Spriel <[email protected]>
    Signed-off-by: John W. Linville <[email protected]>

commit 3fedeab10b3bb09744a6467fe7cd157f055137c3
Author: Hariprasad Shenai <[email protected]>
Date:   Tue Nov 25 08:33:58 2014 +0530

    cxgb4/cxgb4vf/csiostor: Add T4/T5 PCI ID Table
    
    Add a new file t4_pci_id_tbl.h that contains T4/T5 PCI ID Table so that for all
    drivers that uses T4/T5 PCI functions changes can be done in one place.
    
    checkpatch.pl script reports following error, which if tried to fix ends up in
    compilation error.
    
    	ERROR: Macros with complex values should be enclosed in parentheses
    	+#define CH_PCI_DEVICE_ID_TABLE_DEFINE_END \
    	+		{ 0, } \
    	+	}
    
    	WARNING: added, moved or deleted file(s), does MAINTAINERS need updating?
    	new file mode 100644
    
    	ERROR: Macros with complex values should be enclosed in parentheses
    	+#define CH_PCI_ID_TABLE_FENTRY(devid) \
    	+	CH_PCI_ID_TABLE_ENTRY((devid) | \
    	+			      ((CH_PCI_DEVICE_ID_FUNCTION) << 8)), \
    	+	CH_PCI_ID_TABLE_ENTRY((devid) | \
    	+			      ((CH_PCI_DEVICE_ID_FUNCTION2) << 8))
    
    	ERROR: Macros with complex values should be enclosed in parentheses
    	+#define CH_PCI_DEVICE_ID_TABLE_DEFINE_END { 0, } }
    
    	ERROR: Macros with complex values should be enclosed in parentheses
    	+#define CH_PCI_DEVICE_ID_TABLE_DEFINE_END { 0, } }
    
    Signed-off-by: Hariprasad Shenai <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit 138a7f49270fde7547afe976a01cef2b9fbf3a0e
Author: Andrew Lutomirski <[email protected]>
Date:   Mon Nov 24 12:02:29 2014 -0800

    net-timestamp: Fix a documentation typo
    
    SOF_TIMESTAMPING_OPT_ID puts the id in ee_data, not ee_info.
    
    Cc: Willem de Bruijn <[email protected]>
    Signed-off-by: Andy Lutomirski <[email protected]>
    Acked-by: Willem de Bruijn <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>

commit c2d00875c151087c41e23a5afd6bd807019c9a53
Author: Dmitry Monakhov <[email protected]>
Date:   Tue Nov 25 13:18:39 2014 -0500

    ext4: fix potential use after free during resize
    
    We need some sort of synchronization while updating ->s_group_desc
    because there are a lot of users which can access old ->s_group_desc
    array after it was released.  It is reasonable to use lightweight
    seqcount_t here instead of RCU.
    
    Signed-off-by: Dmitry Monakhov <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>

commit d6d12b85f7daa15a02cabfc9026225b6e16d9aad
Author: Dmitry Monakhov <[email protected]>
Date:   Tue Nov 25 13:08:04 2014 -0500

    ext4: cleanup GFP flags inside resize path
    
    We must use GFP_NOFS instead GFP_KERNEL inside ext4_mb_add_groupinfo
    and ext4_calculate_overhead() because they are called from inside a
    journal transaction. Call trace:
    
    ioctl
     ->ext4_group_add
       ->journal_start
       ->ext4_setup_new_descs
         ->ext4_mb_add_groupinfo -> GFP_KERNEL
       ->ext4_flex_group_add
         ->ext4_update_super
           ->ext4_calculate_overhead  -> GFP_KERNEL
       ->journal_stop
    
    Signed-off-by: Dmitry Monakhov <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>

commit 2193dda5eec60373c7a061c129c6ab9d658f78e9
Author: Alan Stern <[email protected]>
Date:   Tue Nov 25 12:28:46 2014 +0100

    USB: host: Remove ehci-octeon and ohci-octeon drivers
    
    Remove special-purpose octeon drivers and instead use ehci-platform
    and ohci-platform as suggested with
    http://marc.info/?l=linux-mips&m=140139694721623&w=2
    
    [andreas.herrmann:
        fixed compile error]
    
    Cc: David Daney <[email protected]>
    Cc: Alex Smith <[email protected]>
    Signed-off-by: Alan Stern <[email protected]>
    Signed-off-by: Andreas Herrmann <[email protected]>
    Acked-by: Ralf Baechle <[email protected]>
    Tested-by: Aaro Koskinen <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f83b050b3c223278c4299d8736ffdafceb2c6c7c
Author: Jan Kara <[email protected]>
Date:   Tue Nov 25 11:55:24 2014 -0500

    ext4: introduce aging to extent status tree
    
    Introduce a simple aging to extent status tree. Each extent has a
    REFERENCED bit which gets set when the extent is used. Shrinker then
    skips entries with referenced bit set and clears the bit. Thus
    frequently used extents have higher chances of staying in memory.
    
    Signed-off-by: Jan Kara <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>

commit ee4bb47d2bc8149b11e4d1dc2378730cb166d5a8
Author: Jan Kara <[email protected]>
Date:   Tue Nov 25 11:53:47 2014 -0500

    ext4: cleanup flag definitions for extent status tree
    
    Currently flags for extent status tree are defined twice, once shifted
    and once without a being shifted. Consolidate these definitions into one
    place and make some computations automatic to make adding flags less
    error prone. Compiler should be clever enough to figure out these are
    constants and generate the same code.
    
    Signed-off-by: Jan Kara <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>

commit 9915b75359e3cc99a4dd3b39f83f394395f8f1aa
Author: Jan Kara <[email protected]>
Date:   Tue Nov 25 11:51:23 2014 -0500

    ext4: limit number of scanned extents in status tree shrinker
    
    Currently we scan extent status trees of inodes until we reclaim nr_to_scan
    extents. This can however require a lot of scanning when there are lots
    of delayed extents (as those cannot be reclaimed).
    
    Change shrinker to work as shrinkers are supposed to and *scan* only
    nr_to_scan extents regardless of how many extents did we actually
    reclaim. We however need to be careful and avoid scanning each status
    tree from the beginning - that could lead to a situation where we would
    not be able to reclaim anything at all when first nr_to_scan extents in
    the tree are always unreclaimable. We remember with each inode offset
    where we stopped scanning and continue from there when we next come
    across the inode.
    
    Note that we also need to update places calling __es_shrink() manually
    to pass reasonable nr_to_scan to have a chance of reclaiming anything and
    not just 1.
    
    Signed-off-by: Jan Kara <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>

commit 149f510220f5df2e3eada0dfc8a0b18208ffaf65
Author: Jan Kara <[email protected]>
Date:   Tue Nov 25 11:49:25 2014 -0500

    ext4: move handling of list of shrinkable inodes into extent status code
    
    Currently callers adding extents to extent status tree were responsible
    for adding the inode to the list of inodes with freeable extents. This
    is error prone and puts list handling in unnecessarily many places.
    
    Just add inode to the list automatically when the first non-delay extent
    is added to the tree and remove inode from the list when the last
    non-delay extent is removed.
    
    Signed-off-by: Jan Kara <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>

commit aaf3ce623d42e534492c19e3b314c800e8d97b84
Author: Zheng Liu <[email protected]>
Date:   Tue Nov 25 11:47:01 2014 -0500

    ext4: change LRU to round-robin in extent status tree shrinker
    
    In this commit we discard the lru algorithm for inodes with extent
    status tree because it takes significant effort to maintain a lru list
    in extent status tree shrinker and the shrinker can take a long time to
    scan this lru list in order to reclaim some objects.
    
    We replace the lru ordering with a simple round-robin.  After that we
    never need to keep a lru list.  That means that the list needn't be
    sorted if the shrinker can not reclaim any objects in the first round.
    
    Cc: Andreas Dilger <[email protected]>
    Signed-off-by: Zheng Liu <[email protected]>
    Signed-off-by: Jan Kara <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>

commit 036d4c3764f230f39fba5b2574a6c29b00a48bf9
Author: Zheng Liu <[email protected]>
Date:   Tue Nov 25 11:44:37 2014 -0500

    ext4: cache extent hole in extent status tree for ext4_da_map_blocks()
    
    Currently extent status tree doesn't cache extent hole when a write
    looks up in extent tree to make sure whether a block has been allocated
    or not.  In this case, we don't put extent hole in extent cache because
    later this extent might be removed and a new delayed extent might be
    added back.  But it will cause a defect when we do a lot of writes.  If
    we don't put extent hole in extent cache, the following writes also need
    to access extent tree to look at whether or not a block has been
    allocated.  It brings a cache miss.  This commit fixes this defect.
    Also if the inode doesn't have any extent, this extent hole will be
    cached as well.
    
    Cc: Andreas Dilger <[email protected]>
    Signed-off-by: Zheng Liu <[email protected]>
    Signed-off-by: Jan Kara <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>

commit f3c08e9bdc8b51aa941aed2fedb4ab468ce7588e
Author: Jan Kara <[email protected]>
Date:   Tue Nov 25 11:41:49 2014 -0500

    ext4: fix block reservation for bigalloc filesystems
    
    For bigalloc filesystems we have to check whether newly requested inode
    block isn't already part of a cluster for which we already have delayed
    allocation reservation. This check happens in ext4_ext_map_blocks() and
    that function sets EXT4_MAP_FROM_CLUSTER if that's the case. However if
    ext4_da_map_blocks() finds in extent cache information about the block,
    we don't call into ext4_ext_map_blocks() and thus we always end up
    getting new reservation even if the space for cluster is already
    reserved. This results in overreservation and premature ENOSPC reports.
    
    Fix the problem by checking for existing cluster reservation already in
    ext4_da_map_blocks(). That simplifies the logic and actually allows us
    to get rid of the EXT4_MAP_FROM_CLUSTER flag completely.
    
    Signed-off-by: Jan Kara <[email protected]>
    Signed-off-by: Theodore Ts'o <[email protected]>

commit 439b8bddaa1ebed9f9f8fb2f6f33f5e639d76ab8
Author: Dmitry Lavnikevich <[email protected]>
Date:   Fri Nov 21 18:29:07 2014 +0300

    mfd: da9063: Get irq base dynamically before registering device
    
    After registering mfd device with proper irq_base
    platform_get_irq_byname() calls will return VIRQ instead of local IRQ.
    This fixes da9063 rtc registration issue:
    da9063-rtc da9063-rtc: Failed to request ALARM IRQ 1: -22
    
    Signed-off-by: Dmitry Lavnikevich <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 2c20f6de95afef89127163d16c88cd0456c48077
Author: Krzysztof Kozlowski <[email protected]>
Date:   Wed Nov 12 16:28:02 2014 +0100

    mfd: max14577: Fix obvious typo in company name in copyright
    
    Fix a typo in name of company in copyright comment.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 0e50e92669357e4702fcd6a85e2f0d6e92295664
Author: Lee Jones <[email protected]>
Date:   Tue Nov 11 12:36:46 2014 +0000

    mfd: axp20x: Constify axp20x_acpi_match and rid unused warning
    
    axp20x.c:239:30:
      warning: ‘axp20x_acpi_match’ defined but not used [-Wunused-variable]
    
    Signed-off-by: Lee Jones <[email protected]>

commit 71d679b84ce8ca3207e547488f70c259575d2f2f
Author: Dmitry Eremin-Solenikov <[email protected]>
Date:   Mon Nov 17 18:07:42 2014 +0300

    mfd: t7l66xb: prepare/unprepare clocks
    
    Change clk_enable/disable() calls to clk_prepare_enable() and
    clk_disable_unprepare().
    
    Signed-off-by: Dmitry Eremin-Solenikov <[email protected]>

commit 7263bd39251e6926ca7fa5591679b26577fdaccb
Author: Dmitry Eremin-Solenikov <[email protected]>
Date:   Mon Nov 17 18:07:43 2014 +0300

    mfd: tc6387xb: prepare/unprepare clocks
    
    Change clk_enable/disable() calls to clk_prepare_enable() and
    clk_disable_unprepare().
    
    Signed-off-by: Dmitry Eremin-Solenikov <[email protected]>

commit 21cf3318d675b6ceeb5a3ed82ffe467a2b6eaee4
Author: Laurentiu Palcu <[email protected]>
Date:   Fri Nov 7 14:45:14 2014 +0200

    mfd: dln2: add support for USB-SPI module
    
    Signed-off-by: Laurentiu Palcu <[email protected]>

commit 783f6fc4cecd770dfdb1418c7c890dbeb3bf3c91
Author: Charles Keepax <[email protected]>
Date:   Tue Nov 4 13:04:07 2014 +0000

    mfd: wm5110: Add missing registers for AIF2 channels 3-6
    
    When the extra 4 channels were added to AIF2 the necessary frame control
    registers were not given defaults and marked readable. This patch fixes
    this.
    
    Signed-off-by: Charles Keepax <[email protected]>

commit 90f2d0f7bf069b1a2798156b7dcc8e7d1e874406
Author: Linus Walleij <[email protected]>
Date:   Tue Oct 28 11:06:56 2014 +0100

    mfd: tc3589x: get rid of static base
    
    The TC3589x driver is now a device tree-only driver, so we want
    only dynamic IRQs and GPIO numbers from the tc3589x, no static
    assignments.
    
    Signed-off-by: Linus Walleij <[email protected]>

commit 47958c5ab4035bd91f05598f76a61cd9f7f2934c
Author: Charles Keepax <[email protected]>
Date:   Tue Nov 4 15:24:36 2014 +0000

    mfd: arizona: Document HP_CTRL_1L and HP_CTRL_1R registers
    
    These registers are documented in the datasheet and used as part of the
    extcon driver. Expose them properly through regmap as the datasheet
    notes they should be treated as volatile do so.
    
    Signed-off-by: Charles Keepax <[email protected]>

commit e62cace7b602b29cc9226e64dfb2c47ddfb9558e
Author: Charles Keepax <[email protected]>
Date:   Tue Nov 4 15:26:22 2014 +0000

    mfd: wm8997: Mark INTERRUPT_STATUS_2_MASK as readable
    
    Technically this register is not used on wm8997 however the regmap core
    requires a continuous block of IRQs. The simplest solution is just to
    add the register.
    
    Signed-off-by: Charles Keepax <[email protected]>

commit a64ab6b4cd098f6c2ea959fe9bf1fd3f8b13b1f3
Author: Dmitry Eremin-Solenikov <[email protected]>
Date:   Thu Nov 6 11:52:38 2014 +0300

    mfd: tc6393xb: Prepare/unprepare clocks
    
    Change clk_enable/disable() calls to clk_prepare_enable() and
    clk_disable_unrepapre().
    
    Signed-off-by: Dmitry Eremin-Solenikov <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 12849b63a4e9e22fb63d0fc967726e8cdf2a19c2
Author: Lee Jones <[email protected]>
Date:   Mon Nov 10 12:28:36 2014 +0000

    mfd: tps65090: Fix bonkers indenting strategy
    
    First spotted pointless (incorrect) indent of 'if (ret)', then double
    indentations of a struct attribute 'mask'.  Decided to go through the
    whole file and make amendments instead and this is the result.
    
    Signed-off-by: Lee Jones <[email protected]>

commit 1a5fb99de4850cba710d91becfa2c65653048589
Author: Dmitry Eremin-Solenikov <[email protected]>
Date:   Fri Oct 24 21:19:57 2014 +0400

    mfd: tc6393xb: Fail ohci suspend if full state restore is required
    
    Some boards with TC6393XB chip require full state restore during system
    resume thanks to chip's VCC being cut off during suspend (Sharp SL-6000
    tosa is one of them). Failing to do so would result in ohci Oops on
    resume due to internal memory contentes being changed. Fail ohci suspend
    on tc6393xb is full state restore is required.
    
    Recommended workaround is to unbind tmio-ohci driver before suspend and
    rebind it after resume.
    
    Cc: [email protected]
    Signed-off-by: Dmitry Eremin-Solenikov <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit bde3e706a63d5c258b3e4f5e327bcf032fb1adfe
Author: Andy Shevchenko <[email protected]>
Date:   Mon Nov 3 19:29:23 2014 +0200

    mfd: lpc_sch: Don't call mfd_remove_devices()
    
    MFD core already cares about failing registration. It will remove successfully
    registered devices in case of error. Thus, no need to repeatedly call
    mfd_remove_devices().
    
    Fixes: 5829e9b64e65 (mfd: lpc_sch: Accomodate partial population of the MFD devices)
    Signed-off-by: Andy Shevchenko <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 1753b40f5c97e0d0bf2f0a562603cfc592945a5e
Author: Joe Perches <[email protected]>
Date:   Sun Oct 26 22:25:02 2014 -0700

    mfd: wm8350-core: Fix probable mask then right shift defect
    
    Precedence of & and >> is not the same and is not left to right.
    shift has higher precedence and should be done after the mask.
    
    Add parentheses around the mask.
    
    Signed-off-by: Joe Perches <[email protected]>
    Acked-by: Charles Keepax <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 7d082baa349e59ce3de6452abc05e5de6436aad4
Author: Guenter Roeck <[email protected]>
Date:   Thu Oct 9 09:18:38 2014 -0700

    mfd: ab8500-sysctrl: Drop ab8500_restart
    
    ab8500_restart is not called from anywhere in the kernel, so drop it.
    
    Signed-off-by: Guenter Roeck <[email protected]>
    Acked-by: Linus Walleij <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 6bdf891a17148a1b91beb603b09c599dc98eb4fb
Author: Lee Jones <[email protected]>
Date:   Mon Nov 3 16:12:26 2014 +0000

    mfd: db8500-prcmu: Provide sane error path values
    
    Also rid superfluous gotos and label.
    
    Cc: Linus Walleij <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 51a7e02bb629498c32915881ed4fb61ef778282a
Author: Pramod Gurav <[email protected]>
Date:   Thu Oct 30 14:51:35 2014 +0530

    mfd: db8500-prcmu: Check return of devm_ioremap for error
    
    Error check around return value of devm_ioremap is missing. Add the same
    to avoid NULL pointer dereference.
    
    Signed-off-by: Pramod Gurav <[email protected]>
    Acked-by: Linus Walleij <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 1b9b46d05f887aec418b3a5f4f55abf79316fcda
Author: Tony Lindgren <[email protected]>
Date:   Sun Nov 2 10:09:38 2014 -0800

    mfd: twl4030-power: Fix regression with missing compatible flag
    
    Commit e7cd1d1eb16f ("mfd: twl4030-power: Add generic reset
    configuration") accidentally removed the compatible flag for
    "ti,twl4030-power" that should be there as documented in the
    binding.
    
    If "ti,twl4030-power" only the poweroff configuration is done
    by the driver.
    
    Fixes: e7cd1d1eb16f ("mfd: twl4030-power: Add generic reset configuration")
    Cc: [email protected] # v3.16+
    Reported-by: "Dr. H. Nikolaus Schaller" <[email protected]>
    Signed-off-by: Tony Lindgren <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 5cb5d9616a47d5383a85379afa4429382ef46b38
Author: Micky Ching <[email protected]>
Date:   Fri Oct 10 13:58:44 2014 +0800

    mfd: rtsx: Fix PM suspend for 5227 & 5249
    
    Fix rts5227&5249 failed send buffer cmd after suspend,
    PM_CTRL3 should reset before send any buffer cmd after suspend.
    Otherwise, buffer cmd will failed, this will lead resume fail.
    
    Signed-off-by: Micky Ching <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 130dd5b039dcbab7bcb2fdce0bb3cc7347b08b29
Author: Krzysztof Kozlowski <[email protected]>
Date:   Tue Oct 21 13:23:16 2014 +0200

    mfd/regulator: dt-bindings: max77686: Document regulators off in suspend
    
    Add information which regulators can be disabled during system suspend.
    
    Suggested-by: Javier Martinez Canillas <[email protected]>
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 6ce286f182e22837a02a368eeb49a0057b2cd5f9
Author: Javier Martinez Canillas <[email protected]>
Date:   Mon Oct 20 23:05:50 2014 +0200

    Revert "mfd: sec-core: Prepare regulators for suspend state to reduce power-consumption"
    
    This reverts commit b7cde7078d2344073c310aa65fc2b0a845d2cb5b
    ("mfd: sec-core: Prepare regulators for suspend state to reduce power-consumption")
    
    Commit b7cde7078d23 called regulator_suspend_prepare() to prepare the
    regulators for a suspend state. But it did from the device pm suspend
    handler while the regulator suspend prepare function iterates over all
    regulators and not only the one managed by this device so it doesn't
    seems to be correct to call it from within a device driver.
    
    It is better to call the regulator suspend prepare/finish functions
    from platform code instead so this patch reverts the mentioned commit.
    
    Suggested-by: Doug Anderson <[email protected]>
    Signed-off-by: Javier Martinez Canillas <[email protected]>
    Reviewed-by: Chanwoo Choi <[email protected]>
    Reviewed-by: Doug Anderson <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit efa3ca414be9b930774b5c1a3190f735596f5115
Author: Krzysztof Kozlowski <[email protected]>
Date:   Mon Oct 20 14:34:46 2014 +0200

    mfd: max77693: Map charger device to its own of_node
    
    Add a "maxim,max77693-charger" of_compatible to the mfd_cell so the MFD
    child device (the charger) will have its own of_node set. This will be
    used by the max77693 charger driver in next patches to obtain battery
    configuration from DTS.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 6f467e5f0cdc3c0304bfcabcbaf56970ddea3d52
Author: Will Sheppard <[email protected]>
Date:   Wed Oct 15 09:38:47 2014 +0100

    mfd: arizona-spi: Add lines after declarations - checkpatch catch
    
    This was found whilst running checkpatch.pl on arizona-spi.
    
    WARNING: Missing a blank line after declarations
    +       struct arizona *arizona = spi_get_drvdata(spi);
    +       arizona_dev_exit(arizona);
    
    Signed-off-by: Will Sheppard <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 6cbac55368324ec2a0e59e192c5b596d0f4569f7
Author: Krzysztof Kozlowski <[email protected]>
Date:   Fri Oct 10 10:23:53 2014 +0200

    mfd: max77693: Remove unused define
    
    Remove old MAX77693_NUM_IRQ_MUIC_REGS define. Not used anywhere.
    
    Signed-off-by: Krzysztof Kozlowski <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 590b7795b3dc293a36136a4321ba59da60e5853c
Author: Boris Brezillon <[email protected]>
Date:   Mon Oct 6 15:48:44 2014 +0200

    mfd: Add documentation for atmel-hlcdc DT bindings
    
    The HLCDC IP available on some Atmel SoCs (i.e. at91sam9n12, at91sam9x5
    family or sama5d3 family) exposes 2 subdevices:
    - a display controller (controlled by a DRM driver)
    - a PWM chip
    
    This patch adds documentation for atmel-hlcdc DT bindings.
    
    Signed-off-by: Boris Brezillon <[email protected]>
    Tested-by: Anthony Harivel <[email protected]>
    Tested-by: Ludovic Desroches <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 2c86e9fb7263dbca2c21a086090d32ba90129f7b
Author: Boris Brezillon <[email protected]>
Date:   Mon Oct 6 15:48:43 2014 +0200

    mfd: Add atmel-hlcdc driver
    
    The HLCDC IP available on some Atmel SoCs (i.e. at91sam9n12, at91sam9x5
    family or sama5d3 family) exposes 2 subdevices:
    - a display controller (controlled by a DRM driver)
    - a PWM chip
    
    The MFD device provides a regmap and several clocks (those connected
    to this hardware block) to its subdevices.
    
    This way concurrent accesses to the iomem range are handled by the regmap
    framework, and each subdevice can safely access HLCDC registers.
    
    Signed-off-by: Boris Brezillon <[email protected]>
    Tested-by: Anthony Harivel <[email protected]>
    Tested-by: Ludovic Desroches <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 6e3f62f0793ebff3f91076490ff0fbb107939701
Author: Johan Hovold <[email protected]>
Date:   Fri Sep 26 12:55:33 2014 +0200

    mfd: core: Fix platform-device id generation
    
    Make sure to always honour multi-function devices registered with
    PLATFORM_DEVID_NONE (-1) or PLATFORM_DEVID_AUTO (-2) as id base. In this
    case it does not make sense to append the cell id to the mfd-id base and
    potentially change the requested behaviour.
    
    Specifically this will allow multi-function devices to be registered
    with PLATFORM_DEVID_AUTO while still having non-zero cell ids.
    
    Signed-off-by: Johan Hovold <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 16b5fe2966b8dc4a474d6618d382d26933d90b24
Author: Johan Hovold <[email protected]>
Date:   Fri Sep 26 12:55:32 2014 +0200

    HID: hid-sensor-hub: Use mfd_add_hotplug_devices() helper
    
    Use mfd_add_hotplug_devices() helper to register the subdevices.
    
    Compile-only tested.
    
    Signed-off-by: Johan Hovold <[email protected]>
    Acked-by: Jiri Kosina <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 1ab589c72ef66f5f281d658ab606e02d661031d8
Author: Johan Hovold <[email protected]>
Date:   Fri Sep 26 12:55:31 2014 +0200

    mfd: Use mfd_add_hotplug_devices() helper
    
    Use mfd_add_hotplug_devices helper to register the subdevices.
    
    Signed-off-by: Johan Hovold <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit bdb0066df96e74a4002125467ebe459feff1ebef
Author: Pankaj Dubey <[email protected]>
Date:   Tue Sep 30 14:05:27 2014 +0530

    mfd: syscon: Decouple syscon interface from platform devices
    
    Currently a syscon entity can be only registered directly through a
    platform device that binds to a dedicated syscon driver. However in
    certain use cases it is desirable to make a device used with another
    driver a syscon interface provider.
    
    For example, certain SoCs (e.g. Exynos) contain system controller
    blocks which perform various functions such as power domain control,
    CPU power management, low power mode control, but in addition contain
    certain IP integration glue, such as various signal masks,
    coprocessor power control, etc. In such case, there is a need to have
    a dedicated driver for such system controller but also share registers
    with other drivers. The latter is where the syscon interface is helpful.
    
    In case of DT based platforms, this patch decouples syscon object from
    syscon platform driver, and allows to create syscon objects first time
    when it is required by calling of syscon_regmap_lookup_by APIs and keep
    a list of such syscon objects along with syscon provider device_nodes
    and regmap handles.
    
    For non-DT based platforms, this patch keeps syscon platform driver
    structure so that syscon can be probed and such non-DT based drivers
    can use syscon_regmap_lookup_by_pdev API and access regmap handles.
    Once all users of "syscon_regmap_lookup_by_pdev" migrated to DT based,
    we can completely remove platform driver of syscon, and keep only helper
    functions to get regmap handles.
    
    Suggested-by: Arnd Bergmann <[email protected]>
    Suggested-by: Tomasz Figa <[email protected]>
    Tested-by: Vivek Gautam <[email protected]>
    Tested-by: Javier Martinez Canillas <[email protected]>
    Signed-off-by: Pankaj Dubey <[email protected]>
    Reviewed-by: Arnd Bergmann <[email protected]>
    Tested-by: Heiko Stuebner <[email protected]>
    Reviewed-by: Heiko Stuebner <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit ee828d02611f325a70ef6a3c1fd2dd1eb3bc9704
Author: Jaewon Kim <[email protected]>
Date:   Thu Sep 18 01:40:26 2014 +0900

    mfd: max77693: Update DT binding to support haptic
    
    This patch add haptic DT binding documentation and example
    to support haptic driver in max77693 Multifunction device.
    
    Signed-off-by: Jaewon Kim <[email protected]>
    Acked-by: Chanwoo Choi <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit d1bafd78fce5f07bfc9c2c8a77146f74528a469e
Author: Jaewon Kim <[email protected]>
Date:   Thu Sep 18 01:40:25 2014 +0900

    mfd: max77693: Add haptic of_compatible in mfd_cell
    
    This patch add haptic of_compatible in order to use the haptic
    device driver using Devicetree.
    
    Signed-off-by: Jaewon Kim <[email protected]>
    Acked-by: Chanwoo Choi <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit efbf49224acc8ba5ac4d7ac93b5035836aebf400
Author: Jaewon Kim <[email protected]>
Date:   Thu Sep 18 01:40:24 2014 +0900

    mfd: max77693: Initialize haptic register map
    
    This patch add regmap_haptic initialization to use haptic register map
    in haptic device driver.
    
    Signed-off-by: Jaewon Kim <[email protected]>
    Acked-by: Chanwoo Choi <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 11d0d30093301169833aedfc130d9e4abe621be1
Author: Johannes Pointner <[email protected]>
Date:   Thu Sep 25 08:31:42 2014 +0200

    mfd: tps65217: Add compatible string for subdevices
    
    Adds of_compatible strings to mfd_cells for sub devices of the tps65217.
    
    Signed-off-by: Johannes Pointner <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 65fa5f773196ccc88c4aae43ece9119f092c20a6
Author: Damien Lespiau <[email protected]>
Date:   Tue Nov 25 13:45:41 2014 +0000

    drm/i915: Fix short description of intel_display_power_is_enabled()
    
    That's the version actually taking the dev_priv->power_domains lock.
    
    Signed-off-by: Damien Lespiau <[email protected]>
    Signed-off-by: Daniel Vetter <[email protected]>

commit 07c802bd7c3951410b105356787d655e273ab537
Author: Will Deacon <[email protected]>
Date:   Tue Nov 25 15:26:13 2014 +0000

    arm64: vmlinux.lds.S: don't discard .exit.* sections at link-time
    
    .exit.* sections may be subject to patching by the new alternatives
    framework and so shouldn't be discarded at link-time. Without this patch,
    such a section will result in the following linker error:
    
    `.exit.text' referenced in section `.altinstructions' of
     drivers/built-in.o: defined in discarded section `.exit.text' of
    drivers/built-in.o
    
    Signed-off-by: Will Deacon <[email protected]>

commit af86e5974d3069bd26ebcf7c046c6e59726acaaa
Author: Laura Abbott <[email protected]>
Date:   Fri Nov 21 21:50:42 2014 +0000

    arm64: Factor out fixmap initialization from ioremap
    
    The fixmap API was originally added for arm64 for
    early_ioremap purposes. It can be used for other purposes too
    so move the initialization from ioremap to somewhere more
    generic. This makes it obvious where the fixmap is being set
    up and allows for a cleaner implementation of __set_fixmap.
    
    Reviewed-by: Kees Cook <[email protected]>
    Acked-by: Mark Rutland <[email protected]>
    Tested-by: Mark Rutland <[email protected]>
    Tested-by: Kees Cook <[email protected]>
    Signed-off-by: Laura Abbott <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>

commit c3684fbb446501b48dec6677a6a9f61c215053de
Author: Laura Abbott <[email protected]>
Date:   Fri Nov 21 21:50:40 2014 +0000

    arm64: Move cpu_resume into the text section
    
    The function cpu_resume currently lives in the .data section.
    There's no reason for it to be there since we can use relative
    instructions without a problem. Move a few cpu_resume data
    structures out of the assembly file so the .data annotation
    can be dropped completely and cpu_resume ends up in the read
    only text section.
    
    Reviewed-by: Kees Cook <[email protected]>
    Reviewed-by: Mark Rutland <[email protected]>
    Reviewed-by: Lorenzo Pieralisi <[email protected]>
    Tested-by: Mark Rutland <[email protected]>
    Tested-by: Lorenzo Pieralisi <[email protected]>
    Tested-by: Kees Cook <[email protected]>
    Acked-by: Ard Biesheuvel <[email protected]>
    Signed-off-by: Laura Abbott <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>

commit ac2dec5f6c27a581f8571da605d9ba04df18330d
Author: Laura Abbott <[email protected]>
Date:   Fri Nov 21 21:50:39 2014 +0000

    arm64: Switch to adrp for loading the stub vectors
    
    The hyp stub vectors are currently loaded using adr. This
    instruction has a +/- 1MB range for the loading address. If
    the alignment for sections is changed the address may be more
    than 1MB away, resulting in reclocation errors. Switch to using
    adrp for getting the address to ensure we aren't affected by the
    location of the __hyp_stub_vectors.
    
    Acked-by: Ard Biesheuvel <[email protected]>
    Acked-by: Marc Zyngier <[email protected]>
    Tested-by: Mark Rutland <[email protected]>
    Tested-by: Kees Cook <[email protected]>
    Signed-off-by: Laura Abbott <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>

commit fcff588633e848aa728a4437ef96d437299ba03d
Author: Laura Abbott <[email protected]>
Date:   Fri Nov 21 21:50:38 2014 +0000

    arm64: Treat handle_arch_irq as a function pointer
    
    handle_arch_irq isn't actually text, it's just a function pointer.
    It doesn't need to be stored in the text section and doing so
    causes problesm if we ever want to make the kernel text read only.
    Declare handle_arch_irq as a proper function pointer stored in
    the data section.
    
    Reviewed-by: Kees Cook <[email protected]>
    Reviewed-by: Mark Rutland <[email protected]>
    Acked-by: Ard Biesheuvel <[email protected]>
    Tested-by: Mark Rutland <[email protected]>
    Tested-by: Kees Cook <[email protected]>
    Signed-off-by: Laura Abbott <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>

commit 3eebdbe5fc7d64c7a6ef14cc5b8be518ffd563fa
Author: Mark Rutland <[email protected]>
Date:   Tue Nov 25 13:27:43 2014 +0000

    arm64: sanity checks: add ID_AA64DFR{0,1}_EL1
    
    While we currently expect self-hosted debug support to be identical
    across CPUs, we don't currently sanity check this.
    
    This patch adds logging of the ID_AA64DFR{0,1}_EL1 values and associated
    sanity checking code.
    
    It's not clear to me whether we need to check PMUVer, TraceVer, and
    DebugVer, as we don't currently rely on these fields at all.
    
    Signed-off-by: Mark Rutland <[email protected]>
    Cc: Catalin Marinas <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>

commit efdf4211d5b103535ae22972acadf57c9fc38b30
Author: Mark Rutland <[email protected]>
Date:   Tue Nov 25 13:27:42 2014 +0000

    arm64: sanity checks: add missing newline to print
    
    A missing newline in the WARN_TAINT_ONCE string results in ugly and
    somewhat difficult to read output in the case of a sanity check failure,
    as the next print does not appear on a new line:
    
      Unsupported CPU feature variation.Modules linked in:
    
    This patch adds the missing newline, fixing the output formatting.
    
    Signed-off-by: Mark Rutland <[email protected]>
    Cc: Catalin Marinas <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>

commit 9760270c36a4d2ac640ea6294f4f8634a8b27121
Author: Mark Rutland <[email protected]>
Date:   Tue Nov 25 13:27:41 2014 +0000

    arm64: sanity checks: ignore ID_MMFR0.AuxReg
    
    It seems that Cortex-A53 r0p4 added support for AIFSR and ADFSR, and
    ID_MMFR0.AuxReg has been updated accordingly to report this fact. As
    Cortex-A53 could be paired with CPUs which do not implement these
    registers (e.g. all current revisions of Cortex-A57), this may trigger a
    sanity check failure at boot.
    
    The AuxReg value describes the availability of the ACTLR, AIFSR, and
    ADFSR registers, which are only of use to 32-bit guest OSs, and have
    IMPLEMENTATION DEFINED contents. Given the nature of these registers it
    is likely that KVM will need to trap accesses regardless of whether the
    CPUs are heterogeneous.
    
    This patch masks out the ID_MMFR0.AuxReg value from the sanity checks,
    preventing spurious warnings at boot time.
    
    Signed-off-by: Mark Rutland <[email protected]>
    Reported-by: Andre Przywara <[email protected]>
    Cc: Catalin Marinas <[email protected]>
    Acked-by: Will Deacon <[email protected]>
    Cc: Marc Zyngier <[email protected]>
    Cc: Peter Maydell <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>

commit 1cefdaea613bcd247b2235079fcbb0ca4687542d
Author: Mark Brown <[email protected]>
Date:   Fri Nov 21 00:36:49 2014 +0000

    arm64: topology: Fix handling of multi-level cluster MPIDR-based detection
    
    The only requirement the scheduler has on cluster IDs is that they must
    be unique.  When enumerating the topology based on MPIDR information the
    kernel currently generates cluster IDs by using the first level of
    affinity above the core ID (either level one or two depending on if the
    core has multiple threads) however the ARMv8 architecture allows for up
    to three levels of affinity.  This means that an ARMv8 system may
    contain cores which have MPIDRs identical other than affinity level
    three which with current code will cause us to report multiple cores
    with the same identification to the scheduler in violation of its
    uniqueness requirement.
    
    Ensure that we do not violate the scheduler requirements on systems that
    uses all the affinity levels by incorporating both affinity levels two
    and three into the cluser ID when the cores are not threaded.
    
    While no currently known hardware uses multi-level clusters it is better
    to program defensively, this will help ease bringup of systems that have
    them and will ensure that things like distribution install media do not
    need to be respun to replace kernels in order to deploy such systems.
    In the worst case the system will work but perform suboptimally until a
    kernel modified to handle the new topology better is installed, in the
    best case this will be an adequate description of such topologies for
    the scheduler to perform well.
    
    Signed-off-by: Mark Brown <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>

commit c0a01b84b1fdbd98bff5bca5b201fe73fda7e9d9
Author: Andre Przywara <[email protected]>
Date:   Fri Nov 14 15:54:12 2014 +0000

    arm64: protect alternatives workarounds with Kconfig options
    
    Not all of the errata we have workarounds for apply necessarily to all
    SoCs, so people compiling a kernel for one very specific SoC may not
    need to patch the kernel.
    Introduce a new submenu in the "Platform selection" menu to allow
    people to turn off certain bugs if they are not affected. By default
    all of them are enabled.
    Normal users or distribution kernels shouldn't bother to deselect any
    bugs here, since the alternatives framework will take care of
    patching them in only if needed.
    
    Signed-off-by: Andre Przywara <[email protected]>
    [will: moved kconfig menu under `Kernel Features']
    Signed-off-by: Will Deacon <[email protected]>

commit 5afaa1fc1b320cec48affa7e6949f2493f875c12
Author: Andre Przywara <[email protected]>
Date:   Fri Nov 14 15:54:11 2014 +0000

    arm64: add Cortex-A57 erratum 832075 workaround
    
    The ARM erratum 832075 applies to certain revisions of Cortex-A57,
    one of the workarounds is to change device loads into using
    load-aquire semantics.
    This is achieved using the alternatives framework.
    
    Signed-off-by: Andre Przywara <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>

commit 301bcfac42897dbd1b0b3c1be49f24654a1bc49e
Author: Andre Przywara <[email protected]>
Date:   Fri Nov 14 15:54:10 2014 +0000

    arm64: add Cortex-A53 cache errata workaround
    
    The ARM errata 819472, 826319, 827319 and 824069 define the same
    workaround for these hardware issues in certain Cortex-A53 parts.
    Use the new alternatives framework and the CPU MIDR detection to
    patch "cache clean" into "cache clean and invalidate" instructions if
    an affected CPU is detected at runtime.
    
    Signed-off-by: Andre Przywara <[email protected]>
    [will: add __maybe_unused to squash gcc warning]
    Signed-off-by: Will Deacon <[email protected]>

commit 159a5e920446aed12fe373ecc3c7b3dc667091ae
Author: Chanwoo Choi <[email protected]>
Date:   Tue Nov 18 17:59:43 2014 +0900

    mfd: s2mps11: Add binding documentation for Samsung S2MPS13 PMIC
    
    This patch adds the binding documentation for Samsung S2MPS13 PMIC
    which is similiar with existing S2MPS14 PMIC. S2MPS13 has the different number
    of regulators from S2MPS14 and RTC/Clock is the same with the S2MPS14.
    
    Signed-off-by: Chanwoo Choi <[email protected]>
    Acked-by: Sangbeom Kim <[email protected]>
    Reviewed-by: Krzysztof Kozlowski <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit f928b53d749bac4514c2ed1ea4d553fa581578b5
Author: Chanwoo Choi <[email protected]>
Date:   Tue Nov 18 17:59:41 2014 +0900

    clk: s2mps11: Add the support for S2MPS13 PMIC clock
    
    This patch adds the support for S2MPS13 PMIC clock which is same with existing
    S2MPS14 RTC IP. But, S2MPS13 uses all of clocks (32khz_{ap|bt|cp}).
    
    Signed-off-by: Chanwoo Choi <[email protected]>
    Reviewed-by: Krzysztof Kozlowski <[email protected]>
    Acked-by: Michael Turquette <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 76b9840b24ae049b39f1b3cf0e49f21b7c41748f
Author: Chanwoo Choi <[email protected]>
Date:   Tue Nov 18 17:59:40 2014 +0900

    regulator: s2mps11: Add support S2MPS13 regulator device
    
    This patch adds S2MPS13 regulator device to existing S2MPS11 device driver.
    The S2MPS13 has just different number of regulators from S2MPS14.
    The S2MPS13 regulator device includes LDO[1-40] and BUCK[1-10].
    
    Signed-off-by: Chanwoo Choi <[email protected]>
    Acked-by: Sangbeom Kim <[email protected]>
    Acked-by: Mark Brown <[email protected]>
    Reviewed-by: Krzysztof Kozlowski <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit 3bc2ee91a470c52fb3979c23c12d43283455f10d
Author: Chanwoo Choi <[email protected]>
Date:   Tue Nov 18 17:59:39 2014 +0900

    mfd: sec-core: Add support for S2MPS13 device
    
    This patch adds the support for Samsung S2MPS13 PMIC device to the sec-core MFD
    driver. The S2MPS13 is very similar with existing S2MPS14 and includes PMIC/
    RTC/CLOCK devices.
    
    Signed-off-by: Chanwoo Choi <[email protected]>
    Acked-by: Sangbeom Kim <[email protected]>
    Signed-off-by: Lee Jones <[email protected]>

commit ce79d54ae447d65117303ca9f61ffe9dcbc2465d
Author: Pantelis Antoniou <[email protected]>
Date:   Tue Oct 28 22:36:05 2014 +0200

    spi/of: Add OF notifier handler
    
    Add OF notifier handler needed for creating/destroying spi devices
    according to dynamic runtime changes in the DT live tree. This code is
    enabled when CONFIG_OF_DYNAMIC is selected.
    
    Signed-off-by: Pantelis Antoniou <[email protected]>
    Signed-off-by: Grant Likely <[email protected]>
    Reviewed-by: Mark Brown <[email protected]>
    Cc: <[email protected]>

commit aff5e3f89a0b07e7edf9243f913378cc27e4110d
Author: Pantelis Antoniou <[email protected]>
Date:   Wed Oct 29 10:40:37 2014 +0200

    spi/of: Create new device registration method and accessors
    
    Dynamically inserting spi device nodes requires the use of a single
    device registration method. Refactor the existing
    of_register_spi_devices() to split out the core functionality for a
    single device into a separate function; of_register_spi_device(). This
    function will be used by the OF_DYNAMIC overlay code to make live
    modifications to the tree.
    
    Methods to lookup a device/master using a device node are added
    as well, of_find_spi_master_by_node() & of_find_spi_device_by_node().
    
    Signed-off-by: Pantelis Antoniou <[email protected]>
    [grant.likely] Split patch into two pieces for clarity
    Signed-off-by: Grant Likely <[email protected]>
    Reviewed-by: Mark Brown <[email protected]>
    Cc: <[email protected]>

commit ea7513bbc04170f1cbf42953187a4d8b731c71c4
Author: Pantelis Antoniou <[email protected]>
Date:   Tue Oct 28 22:36:03 2014 +0200

    i2c/of: Add OF_RECONFIG notifier handler
    
    CONFIG_OF_DYNAMIC enables runtime changes to the device tree which in
    turn may trigger addition or removal of devices from Linux. Add an
    OF_RECONFIG notifier handler to receive tree change events and to
    creating or destroy i2c devices as required.
    
    Signed-off-by: Pantelis Antoniou <[email protected]>
    [grant.likely: clean up #ifdefs and drop unneeded error handling]
    Signed-off-by: Grant Likely <[email protected]>
    Reviewed-by: Wolfram Sang <[email protected]>
    Cc: Rob Herring <[email protected]>
    Cc: [email protected]

commit a430a3455f2c48995e06b359a82a1109a419e9ef
Author: Pantelis Antoniou <[email protected]>
Date:   Tue Oct 28 22:36:02 2014 +0200

    i2c/of: Factor out Devicetree registration code
    
    Dynamically inserting i2c client device nodes requires the use
    of a single device registration method. Factor out the loop body of
    of_i2c_register_devices() so that it can be called for individual
    device_nodes instead of for all the children of a node.
    
    Note: The diff of this commit looks far more complicated than it
    actually is due the indentation being changed for a large block of code.
    When viewed using the diff -w flag to ignore whitespace changes it can
    be seen that the change is actually quite simple.
    
    Signed-off-by: Pantelis Antoniou <[email protected]>
    [grant.likely: Made new function static and removed changes to header]
    Signed-off-by: Grant Likely <[email protected]>
    Reviewed-by: Wolfram Sang <[email protected]>
    Cc: Rob Herring <[email protected]>
    Cc: [email protected]

commit ebf3992061db1f7b3aa093f37fb308acc74fbc82
Author: Tony Lindgren <[email protected]>
Date:   Mon Nov 24 11:05:06 2014 -0800

    usb: musb: Use IS_ENABLED for tusb6010
    
    This removes the ifdef clutter a bit and saves few lines.
    
    It also makes it easier to detect the remaining places
    where we have conditional building of code done based
    on if defined for things like DMA.
    
    Signed-off-by: Tony Lindgren <[email protected]>
    Signed-off-by: Felipe Balbi <[email protected]>

commit 82c02f58ba3a1ee0a067c0f90513e826d6152ba6
Author: Tony Lindgren <[email protected]>
Date:   Mon Nov 24 11:05:05 2014 -0800

    usb: musb: Allow multiple glue layers to be built in
    
    There's no reason any longer to keep it as a choice now that
    the IO access has been fixed.
    
    Signed-off-by: Tony Lindgren <[email protected]>
    Signed-off-by: Felipe Balbi <[email protected]>

commit 8a77f05aa39be879535f22a9757e703581fa1392
Author: Tony Lindgren <[email protected]>
Date:   Mon Nov 24 11:05:04 2014 -0800

    usb: musb: Pass fifo_mode in platform data
    
    This allows setting the correct fifo_mode when multiple
    MUSB glue layers are built-in.
    
    Cc: Fabio Baltieri <[email protected]>
    Cc: Lee Jones <[email protected]>
    Cc: Linus Walleij <[email protected]>
    Cc: Lars-Peter Clausen <[email protected]>
    Acked-by: Apelete Seketeli <[email protected]>
    Signed-off-by: Tony Lindgren <[email protected]>
    Signed-off-by: Felipe Balbi <[email protected]>

commit d026e9c76aac3632af174cf02d5c94defa5e6026
Author: Tony Lindgren <[email protected]>
Date:   Mon Nov 24 11:05:03 2014 -0800

    usb: musb: Change end point selection to use new IO access
    
    This allows the endpoints to work when multiple MUSB glue
    layers are built in.
    
    Cc: Fabio Baltieri <[email protected]>
    Cc: Lee Jones <[email protected]>
    Cc: Lars-Peter Clausen <[email protected]>
    Acked-by: Linus Walleij <[email protected]>
    Acked-by: Apelete Seketeli <[email protected]>
    Signed-off-by: Tony Lindgren <[email protected]>
    Signed-off-by: Felipe Balbi <[email protected]>

commit 1b40fc57a517878cf4c2e16ce29cc9a066dc1064
Author: Tony Lindgren <[email protected]>
Date:   Mon Nov 24 11:05:02 2014 -0800

    usb: musb: Change to use new IO access
    
    Change to use new IO access. This allows us to build in multiple
 …
heftig referenced this pull request in zen-kernel/zen-kernel Dec 7, 2014
@gregkh
aio: fix uncorrent dirty pages accouting when truncating AIO ring buffer
89554d7 
commit 835f252 upstream.

https://bugzilla.kernel.org/show_bug.cgi?id=86831

Markus reported that when shutting down mysqld (with AIO support,
on a ext3 formatted Harddrive) leads to a negative number of dirty pages
(underrun to the counter). The negative number results in a drastic reduction
of the write performance because the page cache is not used, because the kernel
thinks it is still 2 ^ 32 dirty pages open.

Add a warn trace in __dec_zone_state will catch this easily:

static inline void __dec_zone_state(struct zone *zone, enum
	zone_stat_item item)
{
     atomic_long_dec(&zone->vm_stat[item]);
+    WARN_ON_ONCE(item == NR_FILE_DIRTY &&
	atomic_long_read(&zone->vm_stat[item]) < 0);
     atomic_long_dec(&vm_stat[item]);
}

[   21.341632] ------------[ cut here ]------------
[   21.346294] WARNING: CPU: 0 PID: 309 at include/linux/vmstat.h:242
cancel_dirty_page+0x164/0x224()
[   21.355296] Modules linked in: wutbox_cp sata_mv
[   21.359968] CPU: 0 PID: 309 Comm: kworker/0:1 Not tainted 3.14.21-WuT #80
[   21.366793] Workqueue: events free_ioctx
[   21.370760] [<c0016a64>] (unwind_backtrace) from [<c0012f88>]
(show_stack+0x20/0x24)
[   21.378562] [<c0012f88>] (show_stack) from [<c03f8ccc>]
(dump_stack+0x24/0x28)
[   21.385840] [<c03f8ccc>] (dump_stack) from [<c0023ae4>]
(warn_slowpath_common+0x84/0x9c)
[   21.393976] [<c0023ae4>] (warn_slowpath_common) from [<c0023bb8>]
(warn_slowpath_null+0x2c/0x34)
[   21.402800] [<c0023bb8>] (warn_slowpath_null) from [<c00c0688>]
(cancel_dirty_page+0x164/0x224)
[   21.411524] [<c00c0688>] (cancel_dirty_page) from [<c00c080c>]
(truncate_inode_page+0x8c/0x158)
[   21.420272] [<c00c080c>] (truncate_inode_page) from [<c00c0a94>]
(truncate_inode_pages_range+0x11c/0x53c)
[   21.429890] [<c00c0a94>] (truncate_inode_pages_range) from
[<c00c0f6c>] (truncate_pagecache+0x88/0xac)
[   21.439252] [<c00c0f6c>] (truncate_pagecache) from [<c00c0fec>]
(truncate_setsize+0x5c/0x74)
[   21.447731] [<c00c0fec>] (truncate_setsize) from [<c013b3a8>]
(put_aio_ring_file.isra.14+0x34/0x90)
[   21.456826] [<c013b3a8>] (put_aio_ring_file.isra.14) from
[<c013b424>] (aio_free_ring+0x20/0xcc)
[   21.465660] [<c013b424>] (aio_free_ring) from [<c013b4f4>]
(free_ioctx+0x24/0x44)
[   21.473190] [<c013b4f4>] (free_ioctx) from [<c003d8d8>]
(process_one_work+0x134/0x47c)
[   21.481132] [<c003d8d8>] (process_one_work) from [<c003e988>]
(worker_thread+0x130/0x414)
[   21.489350] [<c003e988>] (worker_thread) from [<c00448ac>]
(kthread+0xd4/0xec)
[   21.496621] [<c00448ac>] (kthread) from [<c000ec18>]
(ret_from_fork+0x14/0x20)
[   21.503884] ---[ end trace 79c4bf42c038c9a1 ]---

The cause is that we set the aio ring file pages as *DIRTY* via SetPageDirty
(bypasses the VFS dirty pages increment) when init, and aio fs uses
*default_backing_dev_info* as the backing dev, which does not disable
the dirty pages accounting capability.
So truncating aio ring file will contribute to accounting dirty pages (VFS
dirty pages decrement), then error occurs.

The original goal is keeping these pages in memory (can not be reclaimed
or swapped) in life-time via marking it dirty. But thinking more, we have
already pinned pages via elevating the page's refcount, which can already
achieve the goal, so the SetPageDirty seems unnecessary.

In order to fix the issue, using the __set_page_dirty_no_writeback instead
of the nop .set_page_dirty, and dropped the SetPageDirty (don't manually
set the dirty flags, don't disable set_page_dirty(), rely on default behaviour).

With the above change, the dirty pages accounting can work well. But as we
known, aio fs is an anonymous one, which should never cause any real write-back,
we can ignore the dirty pages (write back) accounting by disabling the dirty
pages (write back) accounting capability. So we introduce an aio private
backing dev info (disabled the ACCT_DIRTY/WRITEBACK/ACCT_WB capabilities) to
replace the default one.

Reported-by: Markus Königshaus <[email protected]>
Signed-off-by: Gu Zheng <[email protected]>
Acked-by: Andrew Morton <[email protected]>
Signed-off-by: Benjamin LaHaise <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
dormando pushed a commit to fastly/linux that referenced this pull request Dec 17, 2014
@gregkh
aio: fix uncorrent dirty pages accouting when truncating AIO ring buffer
2646986 
commit 835f252 upstream.

https://bugzilla.kernel.org/show_bug.cgi?id=86831

Markus reported that when shutting down mysqld (with AIO support,
on a ext3 formatted Harddrive) leads to a negative number of dirty pages
(underrun to the counter). The negative number results in a drastic reduction
of the write performance because the page cache is not used, because the kernel
thinks it is still 2 ^ 32 dirty pages open.

Add a warn trace in __dec_zone_state will catch this easily:

static inline void __dec_zone_state(struct zone *zone, enum
	zone_stat_item item)
{
     atomic_long_dec(&zone->vm_stat[item]);
+    WARN_ON_ONCE(item == NR_FILE_DIRTY &&
	atomic_long_read(&zone->vm_stat[item]) < 0);
     atomic_long_dec(&vm_stat[item]);
}

[   21.341632] ------------[ cut here ]------------
[   21.346294] WARNING: CPU: 0 PID: 309 at include/linux/vmstat.h:242
cancel_dirty_page+0x164/0x224()
[   21.355296] Modules linked in: wutbox_cp sata_mv
[   21.359968] CPU: 0 PID: 309 Comm: kworker/0:1 Not tainted 3.14.21-WuT torvalds#80
[   21.366793] Workqueue: events free_ioctx
[   21.370760] [<c0016a64>] (unwind_backtrace) from [<c0012f88>]
(show_stack+0x20/0x24)
[   21.378562] [<c0012f88>] (show_stack) from [<c03f8ccc>]
(dump_stack+0x24/0x28)
[   21.385840] [<c03f8ccc>] (dump_stack) from [<c0023ae4>]
(warn_slowpath_common+0x84/0x9c)
[   21.393976] [<c0023ae4>] (warn_slowpath_common) from [<c0023bb8>]
(warn_slowpath_null+0x2c/0x34)
[   21.402800] [<c0023bb8>] (warn_slowpath_null) from [<c00c0688>]
(cancel_dirty_page+0x164/0x224)
[   21.411524] [<c00c0688>] (cancel_dirty_page) from [<c00c080c>]
(truncate_inode_page+0x8c/0x158)
[   21.420272] [<c00c080c>] (truncate_inode_page) from [<c00c0a94>]
(truncate_inode_pages_range+0x11c/0x53c)
[   21.429890] [<c00c0a94>] (truncate_inode_pages_range) from
[<c00c0f6c>] (truncate_pagecache+0x88/0xac)
[   21.439252] [<c00c0f6c>] (truncate_pagecache) from [<c00c0fec>]
(truncate_setsize+0x5c/0x74)
[   21.447731] [<c00c0fec>] (truncate_setsize) from [<c013b3a8>]
(put_aio_ring_file.isra.14+0x34/0x90)
[   21.456826] [<c013b3a8>] (put_aio_ring_file.isra.14) from
[<c013b424>] (aio_free_ring+0x20/0xcc)
[   21.465660] [<c013b424>] (aio_free_ring) from [<c013b4f4>]
(free_ioctx+0x24/0x44)
[   21.473190] [<c013b4f4>] (free_ioctx) from [<c003d8d8>]
(process_one_work+0x134/0x47c)
[   21.481132] [<c003d8d8>] (process_one_work) from [<c003e988>]
(worker_thread+0x130/0x414)
[   21.489350] [<c003e988>] (worker_thread) from [<c00448ac>]
(kthread+0xd4/0xec)
[   21.496621] [<c00448ac>] (kthread) from [<c000ec18>]
(ret_from_fork+0x14/0x20)
[   21.503884] ---[ end trace 79c4bf42c038c9a1 ]---

The cause is that we set the aio ring file pages as *DIRTY* via SetPageDirty
(bypasses the VFS dirty pages increment) when init, and aio fs uses
*default_backing_dev_info* as the backing dev, which does not disable
the dirty pages accounting capability.
So truncating aio ring file will contribute to accounting dirty pages (VFS
dirty pages decrement), then error occurs.

The original goal is keeping these pages in memory (can not be reclaimed
or swapped) in life-time via marking it dirty. But thinking more, we have
already pinned pages via elevating the page's refcount, which can already
achieve the goal, so the SetPageDirty seems unnecessary.

In order to fix the issue, using the __set_page_dirty_no_writeback instead
of the nop .set_page_dirty, and dropped the SetPageDirty (don't manually
set the dirty flags, don't disable set_page_dirty(), rely on default behaviour).

With the above change, the dirty pages accounting can work well. But as we
known, aio fs is an anonymous one, which should never cause any real write-back,
we can ignore the dirty pages (write back) accounting by disabling the dirty
pages (write back) accounting capability. So we introduce an aio private
backing dev info (disabled the ACCT_DIRTY/WRITEBACK/ACCT_WB capabilities) to
replace the default one.

Reported-by: Markus Königshaus <[email protected]>
Signed-off-by: Gu Zheng <[email protected]>
Acked-by: Andrew Morton <[email protected]>
Signed-off-by: Benjamin LaHaise <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
ddstreet pushed a commit to ddstreet/linux that referenced this pull request Jun 8, 2015
@mpe
mm/memory_hotplug.c: set zone->wait_table to null after freeing it
7796243 
Izumi found the following oops when hot re-adding a node:

[ 1481.759192] BUG: unable to handle kernel paging request at ffffc90008963690
[ 1481.760192] IP: [<ffffffff810dff80>] __wake_up_bit+0x20/0x70
[ 1481.770098] PGD 86e919067 PUD 207cf003067 PMD 20796d3b067 PTE 0
[ 1481.770098] Oops: 0000 [#1] SMP
[ 1481.770098] CPU: 68 PID: 1237 Comm: rs:main Q:Reg Not tainted 4.1.0-rc5 torvalds#80
[ 1481.770098] Hardware name: FUJITSU PRIMEQUEST2800E/SB, BIOS PRIMEQUEST 2000 Series BIOS Version 1.87 04/28/2015
[ 1481.770098] task: ffff880838df8000 ti: ffff880017b94000 task.ti: ffff880017b94000
[ 1481.770098] RIP: 0010:[<ffffffff810dff80>]  [<ffffffff810dff80>] __wake_up_bit+0x20/0x70
[ 1481.770098] RSP: 0018:ffff880017b97be8  EFLAGS: 00010246
[ 1481.770098] RAX: ffffc90008963690 RBX: 00000000003c0000 RCX: 000000000000a4c9
[ 1481.770098] RDX: 0000000000000000 RSI: ffffea101bffd500 RDI: ffffc90008963648
[ 1481.770098] RBP: ffff880017b97c08 R08: 0000000002000020 R09: 0000000000000000
[ 1481.770098] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a0797c73800
[ 1481.770098] R13: ffffea101bffd500 R14: 0000000000000001 R15: 00000000003c0000
[ 1481.770098] FS:  00007fcc7ffff700(0000) GS:ffff880874800000(0000) knlGS:0000000000000000
[ 1481.770098] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1481.770098] CR2: ffffc90008963690 CR3: 0000000836761000 CR4: 00000000001407e0
[ 1481.770098] Stack:
[ 1481.770098]  ffff8a0797c73800 ffffea1000000000 0000100000000000 0000000069c53212
[ 1481.770098]  ffff880017b97c18 ffffffff811c2a5d ffff880017b97c68 ffffffff8128a0e3
[ 1481.770098]  0000000000000001 000000281bffd500 00000000003c0000 0000000000000028
[ 1481.770098] Call Trace:
[ 1481.770098]  [<ffffffff811c2a5d>] unlock_page+0x6d/0x70
[ 1481.770098]  [<ffffffff8128a0e3>] generic_write_end+0x53/0xb0
[ 1481.770098]  [<ffffffffa0496559>] xfs_vm_write_end+0x29/0x80 [xfs]
[ 1481.770098]  [<ffffffff811c25da>] generic_perform_write+0x10a/0x1e0
[ 1481.770098]  [<ffffffffa04acb4d>] xfs_file_buffered_aio_write+0x14d/0x3e0 [xfs]
[ 1481.770098]  [<ffffffffa04ace59>] xfs_file_write_iter+0x79/0x120 [xfs]
[ 1481.770098]  [<ffffffff8124aac4>] __vfs_write+0xd4/0x110
[ 1481.770098]  [<ffffffff8124b1ac>] vfs_write+0xac/0x1c0
[ 1481.770098]  [<ffffffff8124c0a8>] SyS_write+0x58/0xd0
[ 1481.770098]  [<ffffffff8177eb6e>] system_call_fastpath+0x12/0x76
[ 1481.770098] Code: 5d c3 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5
 48 83 ec 20 65 48 8b 04 25 28 00 00 00 48 89 45 f8 31 c0 48 8d 47 48 <48> 39 47
 48 48 c7 45 e8 00 00 00 00 48 c7 45 f0 00 00 00 00 48
[ 1481.770098] RIP  [<ffffffff810dff80>] __wake_up_bit+0x20/0x70
[ 1481.770098]  RSP <ffff880017b97be8>
[ 1481.770098] CR2: ffffc90008963690
[ 1481.770098] ---[ end trace 25c9882ad3f72923 ]---
[ 1481.770098] Kernel panic - not syncing: Fatal exception
[ 1481.770098] Kernel Offset: disabled
[ 1481.770098] drm_kms_helper: panic occurred, switching back to text console
[ 1481.770098] ---[ end Kernel panic - not syncing: Fatal exception

Reproduce method (re-add a node):
Hot-add nodeA --> remove nodeA --> hot-add nodeA (panic)

This seems an use-after-free problem, and the root cause is
zone->wait_table was not set to *NULL* after free it in try_offline_node.

When hot re-add a node, we will reuse the pgdat of it, so does the zone
struct, and when add pages to the target zone, it will init the zone first
(including the wait_table) if the zone is not initialized.  The judgement
of zone initialized is based on zone->wait_table:

	static inline bool zone_is_initialized(struct zone *zone)
	{
		return !!zone->wait_table;
	}

so if we do not set the zone->wait_table to *NULL* after free it, the
memory hotplug routine will skip the init of new zone when hot re-add the
node, and the wait_table still points to the freed memory, then we will
access the invalid address when trying to wake up the waiting people after
the i/o operation with the page is done, such as mentioned above.

Signed-off-by: Gu Zheng <[email protected]>
Reported-by: Taku Izumi <[email protected]>
Reviewed by: Yasuaki Ishimatsu <[email protected]>
Cc: KAMEZAWA Hiroyuki <[email protected]>
Cc: Tang Chen <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Kaz205 pushed a commit to Kaz205/linux that referenced this pull request Nov 27, 2023
@0xB0D @gregkh
media: qcom: camss: Fix vfe_get() error jump
a97562f 
commit 26bda3d upstream.

Right now it is possible to do a vfe_get() with the internal reference
count at 1. If vfe_check_clock_rates() returns non-zero then we will
leave the reference count as-is and

run:
- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()

skip:
- camss_disable_clocks()

Subsequent vfe_put() calls will when the ref-count is non-zero
unconditionally run:

- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()
- camss_disable_clocks()

vfe_get() should not attempt to roll-back on error when the ref-count is
non-zero as the upper layers will still do their own vfe_put() operations.

vfe_put() will drop the reference count and do the necessary power
domain release, the cleanup jumps in vfe_get() should only be run when
the ref-count is zero.

[   50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ torvalds#80
[   50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023
[   50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   50.095802] pc : refcount_warn_saturate+0xf4/0x148
[   50.095804] lr : refcount_warn_saturate+0xf4/0x148
[   50.095805] sp : ffff80000c7cb8b0
[   50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000
[   50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000
[   50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005
[   50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff
[   50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320
[   50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520
[   50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954
[   50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8
[   50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000
[   50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040
[   50.095835] Call trace:
[   50.095836]  refcount_warn_saturate+0xf4/0x148
[   50.095838]  device_link_put_kref+0x84/0xc8
[   50.095843]  device_link_del+0x38/0x58
[   50.095846]  vfe_pm_domain_off+0x3c/0x50 [qcom_camss]
[   50.095860]  vfe_put+0x114/0x140 [qcom_camss]
[   50.095869]  csid_set_power+0x2c8/0x408 [qcom_camss]
[   50.095878]  pipeline_pm_power_one+0x164/0x170 [videodev]
[   50.095896]  pipeline_pm_power+0xc4/0x110 [videodev]
[   50.095909]  v4l2_pipeline_pm_use+0x5c/0xa0 [videodev]
[   50.095923]  v4l2_pipeline_pm_get+0x1c/0x30 [videodev]
[   50.095937]  video_open+0x7c/0x100 [qcom_camss]
[   50.095945]  v4l2_open+0x84/0x130 [videodev]
[   50.095960]  chrdev_open+0xc8/0x250
[   50.095964]  do_dentry_open+0x1bc/0x498
[   50.095966]  vfs_open+0x34/0x40
[   50.095968]  path_openat+0xb44/0xf20
[   50.095971]  do_filp_open+0xa4/0x160
[   50.095974]  do_sys_openat2+0xc8/0x188
[   50.095975]  __arm64_sys_openat+0x6c/0xb8
[   50.095977]  invoke_syscall+0x50/0x128
[   50.095982]  el0_svc_common.constprop.0+0x4c/0x100
[   50.095985]  do_el0_svc+0x40/0xa8
[   50.095988]  el0_svc+0x2c/0x88
[   50.095991]  el0t_64_sync_handler+0xf4/0x120
[   50.095994]  el0t_64_sync+0x190/0x198
[   50.095996] ---[ end trace 0000000000000000 ]---

Fixes: 7790969 ("media: camss: vfe: Fix runtime PM imbalance on error")
Cc: [email protected]
Signed-off-by: Bryan O'Donoghue <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
mj22226 pushed a commit to mj22226/linux that referenced this pull request Nov 28, 2023
@0xB0D @gregkh
media: qcom: camss: Fix vfe_get() error jump
295b304 
commit 26bda3d upstream.

Right now it is possible to do a vfe_get() with the internal reference
count at 1. If vfe_check_clock_rates() returns non-zero then we will
leave the reference count as-is and

run:
- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()

skip:
- camss_disable_clocks()

Subsequent vfe_put() calls will when the ref-count is non-zero
unconditionally run:

- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()
- camss_disable_clocks()

vfe_get() should not attempt to roll-back on error when the ref-count is
non-zero as the upper layers will still do their own vfe_put() operations.

vfe_put() will drop the reference count and do the necessary power
domain release, the cleanup jumps in vfe_get() should only be run when
the ref-count is zero.

[   50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ torvalds#80
[   50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023
[   50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   50.095802] pc : refcount_warn_saturate+0xf4/0x148
[   50.095804] lr : refcount_warn_saturate+0xf4/0x148
[   50.095805] sp : ffff80000c7cb8b0
[   50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000
[   50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000
[   50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005
[   50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff
[   50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320
[   50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520
[   50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954
[   50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8
[   50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000
[   50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040
[   50.095835] Call trace:
[   50.095836]  refcount_warn_saturate+0xf4/0x148
[   50.095838]  device_link_put_kref+0x84/0xc8
[   50.095843]  device_link_del+0x38/0x58
[   50.095846]  vfe_pm_domain_off+0x3c/0x50 [qcom_camss]
[   50.095860]  vfe_put+0x114/0x140 [qcom_camss]
[   50.095869]  csid_set_power+0x2c8/0x408 [qcom_camss]
[   50.095878]  pipeline_pm_power_one+0x164/0x170 [videodev]
[   50.095896]  pipeline_pm_power+0xc4/0x110 [videodev]
[   50.095909]  v4l2_pipeline_pm_use+0x5c/0xa0 [videodev]
[   50.095923]  v4l2_pipeline_pm_get+0x1c/0x30 [videodev]
[   50.095937]  video_open+0x7c/0x100 [qcom_camss]
[   50.095945]  v4l2_open+0x84/0x130 [videodev]
[   50.095960]  chrdev_open+0xc8/0x250
[   50.095964]  do_dentry_open+0x1bc/0x498
[   50.095966]  vfs_open+0x34/0x40
[   50.095968]  path_openat+0xb44/0xf20
[   50.095971]  do_filp_open+0xa4/0x160
[   50.095974]  do_sys_openat2+0xc8/0x188
[   50.095975]  __arm64_sys_openat+0x6c/0xb8
[   50.095977]  invoke_syscall+0x50/0x128
[   50.095982]  el0_svc_common.constprop.0+0x4c/0x100
[   50.095985]  do_el0_svc+0x40/0xa8
[   50.095988]  el0_svc+0x2c/0x88
[   50.095991]  el0t_64_sync_handler+0xf4/0x120
[   50.095994]  el0t_64_sync+0x190/0x198
[   50.095996] ---[ end trace 0000000000000000 ]---

Fixes: 7790969 ("media: camss: vfe: Fix runtime PM imbalance on error")
Cc: [email protected]
Signed-off-by: Bryan O'Donoghue <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
BoukeHaarsma23 pushed a commit to ChimeraOS/linux that referenced this pull request Nov 28, 2023
@0xB0D @gregkh
media: qcom: camss: Fix vfe_get() error jump
816a407 
commit 26bda3d upstream.

Right now it is possible to do a vfe_get() with the internal reference
count at 1. If vfe_check_clock_rates() returns non-zero then we will
leave the reference count as-is and

run:
- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()

skip:
- camss_disable_clocks()

Subsequent vfe_put() calls will when the ref-count is non-zero
unconditionally run:

- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()
- camss_disable_clocks()

vfe_get() should not attempt to roll-back on error when the ref-count is
non-zero as the upper layers will still do their own vfe_put() operations.

vfe_put() will drop the reference count and do the necessary power
domain release, the cleanup jumps in vfe_get() should only be run when
the ref-count is zero.

[   50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ torvalds#80
[   50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023
[   50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   50.095802] pc : refcount_warn_saturate+0xf4/0x148
[   50.095804] lr : refcount_warn_saturate+0xf4/0x148
[   50.095805] sp : ffff80000c7cb8b0
[   50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000
[   50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000
[   50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005
[   50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff
[   50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320
[   50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520
[   50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954
[   50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8
[   50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000
[   50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040
[   50.095835] Call trace:
[   50.095836]  refcount_warn_saturate+0xf4/0x148
[   50.095838]  device_link_put_kref+0x84/0xc8
[   50.095843]  device_link_del+0x38/0x58
[   50.095846]  vfe_pm_domain_off+0x3c/0x50 [qcom_camss]
[   50.095860]  vfe_put+0x114/0x140 [qcom_camss]
[   50.095869]  csid_set_power+0x2c8/0x408 [qcom_camss]
[   50.095878]  pipeline_pm_power_one+0x164/0x170 [videodev]
[   50.095896]  pipeline_pm_power+0xc4/0x110 [videodev]
[   50.095909]  v4l2_pipeline_pm_use+0x5c/0xa0 [videodev]
[   50.095923]  v4l2_pipeline_pm_get+0x1c/0x30 [videodev]
[   50.095937]  video_open+0x7c/0x100 [qcom_camss]
[   50.095945]  v4l2_open+0x84/0x130 [videodev]
[   50.095960]  chrdev_open+0xc8/0x250
[   50.095964]  do_dentry_open+0x1bc/0x498
[   50.095966]  vfs_open+0x34/0x40
[   50.095968]  path_openat+0xb44/0xf20
[   50.095971]  do_filp_open+0xa4/0x160
[   50.095974]  do_sys_openat2+0xc8/0x188
[   50.095975]  __arm64_sys_openat+0x6c/0xb8
[   50.095977]  invoke_syscall+0x50/0x128
[   50.095982]  el0_svc_common.constprop.0+0x4c/0x100
[   50.095985]  do_el0_svc+0x40/0xa8
[   50.095988]  el0_svc+0x2c/0x88
[   50.095991]  el0t_64_sync_handler+0xf4/0x120
[   50.095994]  el0t_64_sync+0x190/0x198
[   50.095996] ---[ end trace 0000000000000000 ]---

Fixes: 7790969 ("media: camss: vfe: Fix runtime PM imbalance on error")
Cc: [email protected]
Signed-off-by: Bryan O'Donoghue <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Nov 28, 2023
@0xB0D @gregkh
media: qcom: camss: Fix vfe_get() error jump
820b967 
commit 26bda3d upstream.

Right now it is possible to do a vfe_get() with the internal reference
count at 1. If vfe_check_clock_rates() returns non-zero then we will
leave the reference count as-is and

run:
- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()

skip:
- camss_disable_clocks()

Subsequent vfe_put() calls will when the ref-count is non-zero
unconditionally run:

- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()
- camss_disable_clocks()

vfe_get() should not attempt to roll-back on error when the ref-count is
non-zero as the upper layers will still do their own vfe_put() operations.

vfe_put() will drop the reference count and do the necessary power
domain release, the cleanup jumps in vfe_get() should only be run when
the ref-count is zero.

[   50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ torvalds#80
[   50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023
[   50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   50.095802] pc : refcount_warn_saturate+0xf4/0x148
[   50.095804] lr : refcount_warn_saturate+0xf4/0x148
[   50.095805] sp : ffff80000c7cb8b0
[   50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000
[   50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000
[   50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005
[   50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff
[   50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320
[   50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520
[   50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954
[   50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8
[   50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000
[   50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040
[   50.095835] Call trace:
[   50.095836]  refcount_warn_saturate+0xf4/0x148
[   50.095838]  device_link_put_kref+0x84/0xc8
[   50.095843]  device_link_del+0x38/0x58
[   50.095846]  vfe_pm_domain_off+0x3c/0x50 [qcom_camss]
[   50.095860]  vfe_put+0x114/0x140 [qcom_camss]
[   50.095869]  csid_set_power+0x2c8/0x408 [qcom_camss]
[   50.095878]  pipeline_pm_power_one+0x164/0x170 [videodev]
[   50.095896]  pipeline_pm_power+0xc4/0x110 [videodev]
[   50.095909]  v4l2_pipeline_pm_use+0x5c/0xa0 [videodev]
[   50.095923]  v4l2_pipeline_pm_get+0x1c/0x30 [videodev]
[   50.095937]  video_open+0x7c/0x100 [qcom_camss]
[   50.095945]  v4l2_open+0x84/0x130 [videodev]
[   50.095960]  chrdev_open+0xc8/0x250
[   50.095964]  do_dentry_open+0x1bc/0x498
[   50.095966]  vfs_open+0x34/0x40
[   50.095968]  path_openat+0xb44/0xf20
[   50.095971]  do_filp_open+0xa4/0x160
[   50.095974]  do_sys_openat2+0xc8/0x188
[   50.095975]  __arm64_sys_openat+0x6c/0xb8
[   50.095977]  invoke_syscall+0x50/0x128
[   50.095982]  el0_svc_common.constprop.0+0x4c/0x100
[   50.095985]  do_el0_svc+0x40/0xa8
[   50.095988]  el0_svc+0x2c/0x88
[   50.095991]  el0t_64_sync_handler+0xf4/0x120
[   50.095994]  el0t_64_sync+0x190/0x198
[   50.095996] ---[ end trace 0000000000000000 ]---

Fixes: 7790969 ("media: camss: vfe: Fix runtime PM imbalance on error")
Cc: [email protected]
Signed-off-by: Bryan O'Donoghue <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Nov 28, 2023
@0xB0D @gregkh
media: qcom: camss: Fix vfe_get() error jump
04ef31a 
commit 26bda3d upstream.

Right now it is possible to do a vfe_get() with the internal reference
count at 1. If vfe_check_clock_rates() returns non-zero then we will
leave the reference count as-is and

run:
- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()

skip:
- camss_disable_clocks()

Subsequent vfe_put() calls will when the ref-count is non-zero
unconditionally run:

- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()
- camss_disable_clocks()

vfe_get() should not attempt to roll-back on error when the ref-count is
non-zero as the upper layers will still do their own vfe_put() operations.

vfe_put() will drop the reference count and do the necessary power
domain release, the cleanup jumps in vfe_get() should only be run when
the ref-count is zero.

[   50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ torvalds#80
[   50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023
[   50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   50.095802] pc : refcount_warn_saturate+0xf4/0x148
[   50.095804] lr : refcount_warn_saturate+0xf4/0x148
[   50.095805] sp : ffff80000c7cb8b0
[   50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000
[   50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000
[   50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005
[   50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff
[   50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320
[   50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520
[   50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954
[   50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8
[   50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000
[   50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040
[   50.095835] Call trace:
[   50.095836]  refcount_warn_saturate+0xf4/0x148
[   50.095838]  device_link_put_kref+0x84/0xc8
[   50.095843]  device_link_del+0x38/0x58
[   50.095846]  vfe_pm_domain_off+0x3c/0x50 [qcom_camss]
[   50.095860]  vfe_put+0x114/0x140 [qcom_camss]
[   50.095869]  csid_set_power+0x2c8/0x408 [qcom_camss]
[   50.095878]  pipeline_pm_power_one+0x164/0x170 [videodev]
[   50.095896]  pipeline_pm_power+0xc4/0x110 [videodev]
[   50.095909]  v4l2_pipeline_pm_use+0x5c/0xa0 [videodev]
[   50.095923]  v4l2_pipeline_pm_get+0x1c/0x30 [videodev]
[   50.095937]  video_open+0x7c/0x100 [qcom_camss]
[   50.095945]  v4l2_open+0x84/0x130 [videodev]
[   50.095960]  chrdev_open+0xc8/0x250
[   50.095964]  do_dentry_open+0x1bc/0x498
[   50.095966]  vfs_open+0x34/0x40
[   50.095968]  path_openat+0xb44/0xf20
[   50.095971]  do_filp_open+0xa4/0x160
[   50.095974]  do_sys_openat2+0xc8/0x188
[   50.095975]  __arm64_sys_openat+0x6c/0xb8
[   50.095977]  invoke_syscall+0x50/0x128
[   50.095982]  el0_svc_common.constprop.0+0x4c/0x100
[   50.095985]  do_el0_svc+0x40/0xa8
[   50.095988]  el0_svc+0x2c/0x88
[   50.095991]  el0t_64_sync_handler+0xf4/0x120
[   50.095994]  el0t_64_sync+0x190/0x198
[   50.095996] ---[ end trace 0000000000000000 ]---

Fixes: 7790969 ("media: camss: vfe: Fix runtime PM imbalance on error")
Cc: [email protected]
Signed-off-by: Bryan O'Donoghue <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Nov 28, 2023
@0xB0D @gregkh
media: qcom: camss: Fix vfe_get() error jump
f6e014b 
commit 26bda3d upstream.

Right now it is possible to do a vfe_get() with the internal reference
count at 1. If vfe_check_clock_rates() returns non-zero then we will
leave the reference count as-is and

run:
- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()

skip:
- camss_disable_clocks()

Subsequent vfe_put() calls will when the ref-count is non-zero
unconditionally run:

- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()
- camss_disable_clocks()

vfe_get() should not attempt to roll-back on error when the ref-count is
non-zero as the upper layers will still do their own vfe_put() operations.

vfe_put() will drop the reference count and do the necessary power
domain release, the cleanup jumps in vfe_get() should only be run when
the ref-count is zero.

[   50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ torvalds#80
[   50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023
[   50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   50.095802] pc : refcount_warn_saturate+0xf4/0x148
[   50.095804] lr : refcount_warn_saturate+0xf4/0x148
[   50.095805] sp : ffff80000c7cb8b0
[   50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000
[   50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000
[   50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005
[   50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff
[   50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320
[   50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520
[   50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954
[   50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8
[   50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000
[   50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040
[   50.095835] Call trace:
[   50.095836]  refcount_warn_saturate+0xf4/0x148
[   50.095838]  device_link_put_kref+0x84/0xc8
[   50.095843]  device_link_del+0x38/0x58
[   50.095846]  vfe_pm_domain_off+0x3c/0x50 [qcom_camss]
[   50.095860]  vfe_put+0x114/0x140 [qcom_camss]
[   50.095869]  csid_set_power+0x2c8/0x408 [qcom_camss]
[   50.095878]  pipeline_pm_power_one+0x164/0x170 [videodev]
[   50.095896]  pipeline_pm_power+0xc4/0x110 [videodev]
[   50.095909]  v4l2_pipeline_pm_use+0x5c/0xa0 [videodev]
[   50.095923]  v4l2_pipeline_pm_get+0x1c/0x30 [videodev]
[   50.095937]  video_open+0x7c/0x100 [qcom_camss]
[   50.095945]  v4l2_open+0x84/0x130 [videodev]
[   50.095960]  chrdev_open+0xc8/0x250
[   50.095964]  do_dentry_open+0x1bc/0x498
[   50.095966]  vfs_open+0x34/0x40
[   50.095968]  path_openat+0xb44/0xf20
[   50.095971]  do_filp_open+0xa4/0x160
[   50.095974]  do_sys_openat2+0xc8/0x188
[   50.095975]  __arm64_sys_openat+0x6c/0xb8
[   50.095977]  invoke_syscall+0x50/0x128
[   50.095982]  el0_svc_common.constprop.0+0x4c/0x100
[   50.095985]  do_el0_svc+0x40/0xa8
[   50.095988]  el0_svc+0x2c/0x88
[   50.095991]  el0t_64_sync_handler+0xf4/0x120
[   50.095994]  el0t_64_sync+0x190/0x198
[   50.095996] ---[ end trace 0000000000000000 ]---

Fixes: 7790969 ("media: camss: vfe: Fix runtime PM imbalance on error")
Cc: [email protected]
Signed-off-by: Bryan O'Donoghue <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Nov 28, 2023
@0xB0D @gregkh
media: qcom: camss: Fix vfe_get() error jump
8f73338 
commit 26bda3d upstream.

Right now it is possible to do a vfe_get() with the internal reference
count at 1. If vfe_check_clock_rates() returns non-zero then we will
leave the reference count as-is and

run:
- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()

skip:
- camss_disable_clocks()

Subsequent vfe_put() calls will when the ref-count is non-zero
unconditionally run:

- pm_runtime_put_sync()
- vfe->ops->pm_domain_off()
- camss_disable_clocks()

vfe_get() should not attempt to roll-back on error when the ref-count is
non-zero as the upper layers will still do their own vfe_put() operations.

vfe_put() will drop the reference count and do the necessary power
domain release, the cleanup jumps in vfe_get() should only be run when
the ref-count is zero.

[   50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ torvalds#80
[   50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023
[   50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   50.095802] pc : refcount_warn_saturate+0xf4/0x148
[   50.095804] lr : refcount_warn_saturate+0xf4/0x148
[   50.095805] sp : ffff80000c7cb8b0
[   50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000
[   50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000
[   50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005
[   50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff
[   50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320
[   50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520
[   50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954
[   50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8
[   50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000
[   50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040
[   50.095835] Call trace:
[   50.095836]  refcount_warn_saturate+0xf4/0x148
[   50.095838]  device_link_put_kref+0x84/0xc8
[   50.095843]  device_link_del+0x38/0x58
[   50.095846]  vfe_pm_domain_off+0x3c/0x50 [qcom_camss]
[   50.095860]  vfe_put+0x114/0x140 [qcom_camss]
[   50.095869]  csid_set_power+0x2c8/0x408 [qcom_camss]
[   50.095878]  pipeline_pm_power_one+0x164/0x170 [videodev]
[   50.095896]  pipeline_pm_power+0xc4/0x110 [videodev]
[   50.095909]  v4l2_pipeline_pm_use+0x5c/0xa0 [videodev]
[   50.095923]  v4l2_pipeline_pm_get+0x1c/0x30 [videodev]
[   50.095937]  video_open+0x7c/0x100 [qcom_camss]
[   50.095945]  v4l2_open+0x84/0x130 [videodev]
[   50.095960]  chrdev_open+0xc8/0x250
[   50.095964]  do_dentry_open+0x1bc/0x498
[   50.095966]  vfs_open+0x34/0x40
[   50.095968]  path_openat+0xb44/0xf20
[   50.095971]  do_filp_open+0xa4/0x160
[   50.095974]  do_sys_openat2+0xc8/0x188
[   50.095975]  __arm64_sys_openat+0x6c/0xb8
[   50.095977]  invoke_syscall+0x50/0x128
[   50.095982]  el0_svc_common.constprop.0+0x4c/0x100
[   50.095985]  do_el0_svc+0x40/0xa8
[   50.095988]  el0_svc+0x2c/0x88
[   50.095991]  el0t_64_sync_handler+0xf4/0x120
[   50.095994]  el0t_64_sync+0x190/0x198
[   50.095996] ---[ end trace 0000000000000000 ]---

Fixes: 7790969 ("media: camss: vfe: Fix runtime PM imbalance on error")
Cc: [email protected]
Signed-off-by: Bryan O'Donoghue <[email protected]>
Reviewed-by: Laurent Pinchart <[email protected]>
Signed-off-by: Hans Verkuil <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Relms12345 added a commit to Relms12345/linux that referenced this pull request Nov 28, 2023
@Relms12345
Merge tag "v6.1.64" from linux-stable
5d59b64 
commit 6ac30d748bb080752d4078d482534b68d62f685f
Author: Greg Kroah-Hartman <[email protected]>
Date:   Tue Nov 28 17:07:23 2023 +0000

    Linux 6.1.64

    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Salvatore Bonaccorso <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Ron Economos <[email protected]>
    Tested-by: SeongJae Park <[email protected]>
    Tested-by: Pavel Machek (CIP) <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Florian Fainelli <[email protected]>
    Tested-by: Pavel Machek (CIP) <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: SeongJae Park <[email protected]>
    Tested-by: Florian Fainelli <[email protected]>
    Tested-by: Nam Cao <[email protected]>
    Tested-by: Jon Hunter <[email protected]>
    Tested-by: Guenter Roeck <[email protected]>
    Tested-by: Conor Dooley <[email protected]>
    Tested-by: Allen Pais <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 04ff8a5107a56ad6ba87c1e89c7c520e851e4ffa
Author: Conor Dooley <[email protected]>
Date:   Thu Jun 29 12:33:34 2023 +0100

    RISC-V: drop error print from riscv_hartid_to_cpuid()

    commit 52909f1768023656d5c429873e2246a134289a95 upstream.

    As of commit 2ac874343749 ("RISC-V: split early & late of_node to
    hartid mapping") my CI complains about newly added pr_err() messages
    during boot, for example:
    [    0.000000] Couldn't find cpu id for hartid [0]
    [    0.000000] riscv-intc: unable to find hart id for /cpus/cpu@0/interrupt-controller

    Before the split, riscv_of_processor_hartid() contained a check for
    whether the cpu was "available", before calling riscv_hartid_to_cpuid(),
    but after the split riscv_of_processor_hartid() can be called for cpus
    that are disabled.

    Most callers of riscv_hartid_to_cpuid() already report custom errors
    where it falls, making this print superfluous in those case. In other
    places, the print adds nothing - see riscv_intc_init() for example.

    Fixes: 2ac874343749 ("RISC-V: split early & late of_node to hartid mapping")
    Signed-off-by: Conor Dooley <[email protected]>
    Link: https://lore.kernel.org/r/20230629-paternity-grafted-b901b76d04a0@wendy
    Signed-off-by: Palmer Dabbelt <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 9e1e0887ea21e9fef0f1a2a3ad715f9a3aa9535d
Author: Robert Richter <[email protected]>
Date:   Fri May 19 23:54:35 2023 +0200

    cxl/port: Fix NULL pointer access in devm_cxl_add_port()

    commit a70fc4ed20a6118837b0aecbbf789074935f473b upstream.

    In devm_cxl_add_port() the port creation may fail and its associated
    pointer does not contain a valid address. During error message
    generation this invalid port address is used. Fix that wrong address
    access.

    Fixes: f3cd264c4ec1 ("cxl: Unify debug messages when calling devm_cxl_add_port()")
    Signed-off-by: Robert Richter <[email protected]>
    Reviewed-by: Dave Jiang <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Dan Williams <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c88cfbb18a5e498f405836b11f1dd31c54d7a7de
Author: Victor Shih <[email protected]>
Date:   Tue Nov 7 17:57:41 2023 +0800

    mmc: sdhci-pci-gli: GL9755: Mask the replay timer timeout of AER

    commit 85dd3af64965c1c0eb7373b340a1b1f7773586b0 upstream.

    Due to a flaw in the hardware design, the GL9755 replay timer frequently
    times out when ASPM is enabled. As a result, the warning messages will
    often appear in the system log when the system accesses the GL9755
    PCI config. Therefore, the replay timer timeout must be masked.

    Fixes: 36ed2fd32b2c ("mmc: sdhci-pci-gli: A workaround to allow GL9755 to enter ASPM L1.2")
    Signed-off-by: Victor Shih <[email protected]>
    Acked-by: Adrian Hunter <[email protected]>
    Acked-by: Kai-Heng Feng <[email protected]>
    Cc: [email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Victor Shih <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 2132941b453fc933dde89b8f96f0a4439ded5c74
Author: Vicki Pfau <[email protected]>
Date:   Thu Mar 23 18:32:43 2023 -0700

    Input: xpad - add VID for Turtle Beach controllers

    commit 1999a6b12a3b5c8953fc9ec74863ebc75a1b851d upstream.

    This adds support for the Turtle Beach REACT-R and Recon Xbox controllers

    Signed-off-by: Vicki Pfau <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Dmitry Torokhov <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 2fa74d29fc1899c237d51bf9a6e132ea5c488976
Author: Steven Rostedt (Google) <[email protected]>
Date:   Tue Oct 31 12:24:53 2023 -0400

    tracing: Have trace_event_file have ref counters

    commit bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 upstream.

    The following can crash the kernel:

     # cd /sys/kernel/tracing
     # echo 'p:sched schedule' > kprobe_events
     # exec 5>>events/kprobes/sched/enable
     # > kprobe_events
     # exec 5>&-

    The above commands:

     1. Change directory to the tracefs directory
     2. Create a kprobe event (doesn't matter what one)
     3. Open bash file descriptor 5 on the enable file of the kprobe event
     4. Delete the kprobe event (removes the files too)
     5. Close the bash file descriptor 5

    The above causes a crash!

     BUG: kernel NULL pointer dereference, address: 0000000000000028
     #PF: supervisor read access in kernel mode
     #PF: error_code(0x0000) - not-present page
     PGD 0 P4D 0
     Oops: 0000 [#1] PREEMPT SMP PTI
     CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186
     Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
     RIP: 0010:tracing_release_file_tr+0xc/0x50

    What happens here is that the kprobe event creates a trace_event_file
    "file" descriptor that represents the file in tracefs to the event. It
    maintains state of the event (is it enabled for the given instance?).
    Opening the "enable" file gets a reference to the event "file" descriptor
    via the open file descriptor. When the kprobe event is deleted, the file is
    also deleted from the tracefs system which also frees the event "file"
    descriptor.

    But as the tracefs file is still opened by user space, it will not be
    totally removed until the final dput() is called on it. But this is not
    true with the event "file" descriptor that is already freed. If the user
    does a write to or simply closes the file descriptor it will reference the
    event "file" descriptor that was just freed, causing a use-after-free bug.

    To solve this, add a ref count to the event "file" descriptor as well as a
    new flag called "FREED". The "file" will not be freed until the last
    reference is released. But the FREE flag will be set when the event is
    removed to prevent any more modifications to that event from happening,
    even if there's still a reference to the event "file" descriptor.

    Link: https://lore.kernel.org/linux-trace-kernel/[email protected]/
    Link: https://lore.kernel.org/linux-trace-kernel/[email protected]

    Cc: [email protected]
    Cc: Mark Rutland <[email protected]>
    Fixes: f5ca233e2e66d ("tracing: Increase trace array ref count on enable and filter files")
    Reported-by: Beau Belgrave <[email protected]>
    Tested-by: Beau Belgrave <[email protected]>
    Reviewed-by: Masami Hiramatsu (Google) <[email protected]>
    Signed-off-by: Steven Rostedt (Google) <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6460508dce00f5438d95e3ee7096c925e30e72e2
Author: Michael Ellerman <[email protected]>
Date:   Tue Aug 22 00:28:19 2023 +1000

    powerpc/powernv: Fix fortify source warnings in opal-prd.c

    commit feea65a338e52297b68ceb688eaf0ffc50310a83 upstream.

    As reported by Mahesh & Aneesh, opal_prd_msg_notifier() triggers a
    FORTIFY_SOURCE warning:

      memcpy: detected field-spanning write (size 32) of single field "&item->msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4)
      WARNING: CPU: 9 PID: 660 at arch/powerpc/platforms/powernv/opal-prd.c:355 opal_prd_msg_notifier+0x174/0x188 [opal_prd]
      NIP opal_prd_msg_notifier+0x174/0x188 [opal_prd]
      LR  opal_prd_msg_notifier+0x170/0x188 [opal_prd]
      Call Trace:
        opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable)
        notifier_call_chain+0xc0/0x1b0
        atomic_notifier_call_chain+0x2c/0x40
        opal_message_notify+0xf4/0x2c0

    This happens because the copy is targeting item->msg, which is only 4
    bytes in size, even though the enclosing item was allocated with extra
    space following the msg.

    To fix the warning define struct opal_prd_msg with a union of the header
    and a flex array, and have the memcpy target the flex array.

    Reported-by: "Aneesh Kumar K.V" <[email protected]>
    Reported-by: Mahesh Salgaonkar <[email protected]>
    Tested-by: Mahesh Salgaonkar <[email protected]>
    Reviewed-by: Mahesh Salgaonkar <[email protected]>
    Signed-off-by: Michael Ellerman <[email protected]>
    Link: https://msgid.link/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 4c55be0855344187d0970874b6e1215b21a68b61
Author: Lewis Huang <[email protected]>
Date:   Thu Oct 19 17:22:21 2023 +0800

    drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox

    commit 5911d02cac70d7fb52009fbd37423e63f8f6f9bc upstream.

    [WHY]
    Flush command sent to DMCUB spends more time for execution on
    a dGPU than on an APU. This causes cursor lag when using high
    refresh rate mouses.

    [HOW]
    1. Change the DMCUB mailbox memory location from FB to inbox.
    2. Only change windows memory to inbox.

    Cc: Mario Limonciello <[email protected]>
    Cc: Alex Deucher <[email protected]>
    Cc: [email protected]
    Reviewed-by: Nicholas Kazlauskas <[email protected]>
    Acked-by: Alex Hung <[email protected]>
    Signed-off-by: Lewis Huang <[email protected]>
    Tested-by: Daniel Wheeler <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 68d774eb10e261ac6d176da2379f97a62878ef22
Author: Tianci Yin <[email protected]>
Date:   Wed Nov 1 09:47:13 2023 +0800

    drm/amd/display: Enable fast plane updates on DCN3.2 and above

    commit 435f5b369657cffee4b04db1f5805b48599f4dbe upstream.

    [WHY]
    When cursor moves across screen boarder, lag cursor observed,
    since subvp settings need to sync up with vblank that causes
    cursor updates being delayed.

    [HOW]
    Enable fast plane updates on DCN3.2 to fix it.

    Cc: Mario Limonciello <[email protected]>
    Cc: Alex Deucher <[email protected]>
    Cc: [email protected]
    Reviewed-by: Aurabindo Pillai <[email protected]>
    Acked-by: Alex Hung <[email protected]>
    Signed-off-by: Tianci Yin <[email protected]>
    Tested-by: Daniel Wheeler <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fb5c134ca589fe670430acc9e7ebf2691ca2476d
Author: Mario Limonciello <[email protected]>
Date:   Wed Nov 8 13:31:57 2023 -0600

    drm/amd/display: fix a NULL pointer dereference in amdgpu_dm_i2c_xfer()

    commit b71f4ade1b8900d30c661d6c27f87c35214c398c upstream.

    When ddc_service_construct() is called, it explicitly checks both the
    link type and whether there is something on the link which will
    dictate whether the pin is marked as hw_supported.

    If the pin isn't set or the link is not set (such as from
    unloading/reloading amdgpu in an IGT test) then fail the
    amdgpu_dm_i2c_xfer() call.

    Cc: [email protected]
    Fixes: 22676bc500c2 ("drm/amd/display: Fix dmub soft hang for PSR 1")
    Link: https://github.com/fwupd/fwupd/issues/6327
    Signed-off-by: Mario Limonciello <[email protected]>
    Reviewed-by: Harry Wentland <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 51ffa1a3792e3570ae2eb84d003c329b3d71da6c
Author: Christian König <[email protected]>
Date:   Thu Nov 9 10:14:14 2023 +0100

    drm/amdgpu: lower CS errors to debug severity

    commit 17daf01ab4e3e5a5929747aa05cc15eb2bad5438 upstream.

    Otherwise userspace can spam the logs by using incorrect input values.

    Signed-off-by: Christian König <[email protected]>
    Reviewed-by: Alex Deucher <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Cc: [email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit c52aac5884bc58e304d4c9cb8441baf8443ea189
Author: Christian König <[email protected]>
Date:   Thu Nov 9 10:12:39 2023 +0100

    drm/amdgpu: fix error handling in amdgpu_bo_list_get()

    commit 12f76050d8d4d10dab96333656b821bd4620d103 upstream.

    We should not leak the pointer where we couldn't grab the reference
    on to the caller because it can be that the error handling still
    tries to put the reference then.

    Signed-off-by: Christian König <[email protected]>
    Reviewed-by: Alex Deucher <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Cc: [email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 2ab6c1237bd4a961b8d5032671510a028fb9f0f6
Author: Alex Deucher <[email protected]>
Date:   Tue Oct 17 15:40:01 2023 -0400

    drm/amdgpu: don't use ATRM for external devices

    commit 432e664e7c98c243fab4c3c95bd463bea3aeed28 upstream.

    The ATRM ACPI method is for fetching the dGPU vbios rom
    image on laptops and all-in-one systems.  It should not be
    used for external add in cards.  If the dGPU is thunderbolt
    connected, don't try ATRM.

    v2: pci_is_thunderbolt_attached only works for Intel.  Use
        pdev->external_facing instead.
    v3: dev_is_removable() seems to be what we want

    Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2925
    Reviewed-by: Mario Limonciello <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Cc: [email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 965dce07a4fc5b15c07c73124f5016240a7250ef
Author: Alex Deucher <[email protected]>
Date:   Tue Oct 17 16:30:00 2023 -0400

    drm/amdgpu: don't use pci_is_thunderbolt_attached()

    commit 7b1c6263eaf4fd64ffe1cafdc504a42ee4bfbb33 upstream.

    It's only valid on Intel systems with the Intel VSEC.
    Use dev_is_removable() instead.  This should do the right
    thing regardless of the platform.

    Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2925
    Reviewed-by: Mario Limonciello <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Cc: [email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 8e54a91d3e66b9730861f10345238ff5ef979d3d
Author: Alex Deucher <[email protected]>
Date:   Wed Nov 1 15:48:14 2023 -0400

    drm/amdgpu/smu13: drop compute workload workaround

    commit 23170863ea0a0965d224342c0eb2ad8303b1f267 upstream.

    This was fixed in PMFW before launch and is no longer
    required.

    Reviewed-by: Yang Wang <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Cc: [email protected] # 6.1.x
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 454d0cdd7c127bb0ad06b53c52e94ca2c9a83b20
Author: Ma Jun <[email protected]>
Date:   Tue Oct 31 11:11:04 2023 +0800

    drm/amd/pm: Fix error of MACO flag setting code

    commit 7f3e6b840fa8b0889d776639310a5dc672c1e9e1 upstream.

    MACO only works if BACO is supported

    Signed-off-by: Ma Jun <[email protected]>
    Reviewed-by: Kenneth Feng <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Cc: [email protected] # 6.1.x
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 07e94f204f38b0d36eb377b3cda088b4a8b6f9a2
Author: Kunwu Chan <[email protected]>
Date:   Fri Nov 3 11:09:22 2023 +0000

    drm/i915: Fix potential spectre vulnerability

    commit 1a8e9bad6ef563c28ab0f8619628d5511be55431 upstream.

    Fix smatch warning:
    drivers/gpu/drm/i915/gem/i915_gem_context.c:847 set_proto_ctx_sseu()
    warn: potential spectre issue 'pc->user_engines' [r] (local cap)

    Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)")
    Cc: <[email protected]> # v5.15+
    Signed-off-by: Kunwu Chan <[email protected]>
    Reviewed-by: Tvrtko Ursulin <[email protected]>
    Signed-off-by: Tvrtko Ursulin <[email protected]>
    Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
    (cherry picked from commit 27b086382c22efb7e0a16442f7bdc2e120108ef3)
    Signed-off-by: Jani Nikula <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 9457636a49265bdec14f3b747a4911ea9b7d468c
Author: Ville Syrjälä <[email protected]>
Date:   Tue Oct 31 18:08:00 2023 +0200

    drm/i915: Bump GLK CDCLK frequency when driving multiple pipes

    commit 0cb89cd42fd22bbdec0b046c48f35775f5b88bdb upstream.

    On GLK CDCLK frequency needs to be at least 2*96 MHz when accessing
    the audio hardware. Currently we bump the CDCLK frequency up
    temporarily (if not high enough already) whenever audio hardware
    is being accessed, and drop it back down afterwards.

    With a single active pipe this works just fine as we can switch
    between all the valid CDCLK frequencies by changing the cd2x
    divider, which doesn't require a full modeset. However with
    multiple active pipes the cd2x divider trick no longer works,
    and thus we end up blinking all displays off and back on.

    To avoid this let's just bump the CDCLK frequency to >=2*96MHz
    whenever multiple pipes are active. The downside is slightly
    higher power consumption, but that seems like an acceptable
    tradeoff. With a single active pipe we can stick to the current
    more optiomal (from power comsumption POV) behaviour.

    Cc: [email protected]
    Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9599
    Signed-off-by: Ville Syrjälä <[email protected]>
    Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
    Reviewed-by: Jani Nikula <[email protected]>
    (cherry picked from commit 451eaa1a614c911f5a51078dcb68022874e4cb12)
    Signed-off-by: Jani Nikula <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e973f40de16125f3f85a07db68a2ad4a0aeb42c2
Author: Bas Nieuwenhuizen <[email protected]>
Date:   Tue Oct 17 16:01:35 2023 +0200

    drm/amd/pm: Handle non-terminated overdrive commands.

    commit 08e9ebc75b5bcfec9d226f9e16bab2ab7b25a39a upstream.

    The incoming strings might not be terminated by a newline
    or a 0.

    (found while testing a program that just wrote the string
     itself, causing a crash)

    Cc: [email protected]
    Fixes: e3933f26b657 ("drm/amd/pp: Add edit/commit/show OD clock/voltage support in sysfs")
    Signed-off-by: Bas Nieuwenhuizen <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit dc4542861ec8dde92c3c8a5139bc412860aebe60
Author: Jan Kara <[email protected]>
Date:   Fri Oct 13 14:13:50 2023 +0200

    ext4: properly sync file size update after O_SYNC direct IO

    commit 91562895f8030cb9a0470b1db49de79346a69f91 upstream.

    Gao Xiang has reported that on ext4 O_SYNC direct IO does not properly
    sync file size update and thus if we crash at unfortunate moment, the
    file can have smaller size although O_SYNC IO has reported successful
    completion. The problem happens because update of on-disk inode size is
    handled in ext4_dio_write_iter() *after* iomap_dio_rw() (and thus
    dio_complete() in particular) has returned and generic_file_sync() gets
    called by dio_complete(). Fix the problem by handling on-disk inode size
    update directly in our ->end_io completion handler.

    References: https://lore.kernel.org/all/[email protected]
    Reported-by: Gao Xiang <[email protected]>
    CC: [email protected]
    Fixes: 378f32bab371 ("ext4: introduce direct I/O write using iomap infrastructure")
    Signed-off-by: Jan Kara <[email protected]>
    Tested-by: Joseph Qi <[email protected]>
    Reviewed-by: "Ritesh Harjani (IBM)" <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e1d0f68bc07fee57d1855355dbb94092b895a9f4
Author: Kemeng Shi <[email protected]>
Date:   Sun Aug 27 01:47:01 2023 +0800

    ext4: add missed brelse in update_backups

    commit 9adac8b01f4be28acd5838aade42b8daa4f0b642 upstream.

    add missed brelse in update_backups

    Signed-off-by: Kemeng Shi <[email protected]>
    Reviewed-by: Theodore Ts'o <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Cc: [email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1793dc461e5a081087ab4d34b39b838bdce3f7e9
Author: Kemeng Shi <[email protected]>
Date:   Sun Aug 27 01:47:03 2023 +0800

    ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks

    commit 40dd7953f4d606c280074f10d23046b6812708ce upstream.

    Wrong check of gdb backup in meta bg as following:
    first_group is the first group of meta_bg which contains target group, so
    target group is always >= first_group. We check if target group has gdb
    backup by comparing first_group with [group + 1] and [group +
    EXT4_DESC_PER_BLOCK(sb) - 1]. As group >= first_group, then [group + N] is
    > first_group. So no copy of gdb backup in meta bg is done in
    setup_new_flex_group_blocks.

    No need to do gdb backup copy in meta bg from setup_new_flex_group_blocks
    as we always copy updated gdb block to backups at end of
    ext4_flex_group_add as following:

    ext4_flex_group_add
      /* no gdb backup copy for meta bg any more */
      setup_new_flex_group_blocks

      /* update current group number */
      ext4_update_super
        sbi->s_groups_count += flex_gd->count;

      /*
       * if group in meta bg contains backup is added, the primary gdb block
       * of the meta bg will be copy to backup in new added group here.
       */
      for (; gdb_num <= gdb_num_end; gdb_num++)
        update_backups(...)

    In summary, we can remove wrong gdb backup copy code in
    setup_new_flex_group_blocks.

    Signed-off-by: Kemeng Shi <[email protected]>
    Reviewed-by: Theodore Ts'o <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Cc: [email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 80ddcf21e7e022b392d9ae8363c0353251a95034
Author: Zhang Yi <[email protected]>
Date:   Thu Aug 24 17:26:04 2023 +0800

    ext4: correct the start block of counting reserved clusters

    commit 40ea98396a3659062267d1fe5f99af4f7e4f05e3 upstream.

    When big allocate feature is enabled, we need to count and update
    reserved clusters before removing a delayed only extent_status entry.
    {init|count|get}_rsvd() have already done this, but the start block
    number of this counting isn't correct in the following case.

      lblk            end
       |               |
       v               v
              -------------------------
              |                       | orig_es
              -------------------------
                       ^              ^
          len1 is 0    |     len2     |

    If the start block of the orig_es entry founded is bigger than lblk, we
    passed lblk as start block to count_rsvd(), but the length is correct,
    finally, the range to be counted is offset. This patch fix this by
    passing the start blocks to 'orig_es->lblk + len1'.

    Signed-off-by: Zhang Yi <[email protected]>
    Cc: [email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Reviewed-by: Jan Kara <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ec4ba3d62f0fdde57cfaaeb7f1df85609b9a86ef
Author: Kemeng Shi <[email protected]>
Date:   Sun Aug 27 01:47:02 2023 +0800

    ext4: correct return value of ext4_convert_meta_bg

    commit 48f1551592c54f7d8e2befc72a99ff4e47f7dca0 upstream.

    Avoid to ignore error in "err".

    Signed-off-by: Kemeng Shi <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Cc: [email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 32b9fb9a67ec70bbe3afe931b0ea44203150a49a
Author: Ojaswin Mujoo <[email protected]>
Date:   Mon Sep 18 16:15:50 2023 +0530

    ext4: mark buffer new if it is unwritten to avoid stale data exposure

    commit 2cd8bdb5efc1e0d5b11a4b7ba6b922fd2736a87f upstream.

    ** Short Version **

    In ext4 with dioread_nolock, we could have a scenario where the bh returned by
    get_blocks (ext4_get_block_unwritten()) in __block_write_begin_int() has
    UNWRITTEN and MAPPED flag set. Since such a bh does not have NEW flag set we
    never zero out the range of bh that is not under write, causing whatever stale
    data is present in the folio at that time to be written out to disk. To fix this
    mark the buffer as new, in case it is unwritten, in ext4_get_block_unwritten().

    ** Long Version **

    The issue mentioned above was resulting in two different bugs:

    1. On block size < page size case in ext4, generic/269 was reliably
    failing with dioread_nolock. The state of the write was as follows:

      * The write was extending i_size.
      * The last block of the file was fallocated and had an unwritten extent
      * We were near ENOSPC and hence we were switching to non-delayed alloc
        allocation.

    In this case, the back trace that triggers the bug is as follows:

      ext4_da_write_begin()
        /* switch to nodelalloc due to low space */
        ext4_write_begin()
          ext4_should_dioread_nolock() // true since mount flags still have delalloc
          __block_write_begin(..., ext4_get_block_unwritten)
            __block_write_begin_int()
              for(each buffer head in page) {
                /* first iteration, this is bh1 which contains i_size */
                if (!buffer_mapped)
                  get_block() /* returns bh with only UNWRITTEN and MAPPED */
                /* second iteration, bh2 */
                  if (!buffer_mapped)
                    get_block() /* we fail here, could be ENOSPC */
              }
              if (err)
                /*
                 * this would zero out all new buffers and mark them uptodate.
                 * Since bh1 was never marked new, we skip it here which causes
                 * the bug later.
                 */
                folio_zero_new_buffers();
          /* ext4_wrte_begin() error handling */
          ext4_truncate_failed_write()
            ext4_truncate()
              ext4_block_truncate_page()
                __ext4_block_zero_page_range()
                  if(!buffer_uptodate())
                    ext4_read_bh_lock()
                      ext4_read_bh() -> ... ext4_submit_bh_wbc()
                        BUG_ON(buffer_unwritten(bh)); /* !!! */

    2. The second issue is stale data exposure with page size >= blocksize
    with dioread_nolock. The conditions needed for it to happen are same as
    the previous issue ie dioread_nolock around ENOSPC condition. The issue
    is also similar where in __block_write_begin_int() when we call
    ext4_get_block_unwritten() on the buffer_head and the underlying extent
    is unwritten, we get an unwritten and mapped buffer head. Since it is
    not new, we never zero out the partial range which is not under write,
    thus writing stale data to disk. This can be easily observed with the
    following reproducer:

     fallocate -l 4k testfile
     xfs_io -c "pwrite 2k 2k" testfile
     # hexdump output will have stale data in from byte 0 to 2k in testfile
     hexdump -C testfile

    NOTE: To trigger this, we need dioread_nolock enabled and write happening via
    ext4_write_begin(), which is usually used when we have -o nodealloc. Since
    dioread_nolock is disabled with nodelalloc, the only alternate way to call
    ext4_write_begin() is to ensure that delayed alloc switches to nodelalloc ie
    ext4_da_write_begin() calls ext4_write_begin(). This will usually happen when
    ext4 is almost full like the way generic/269 was triggering it in Issue 1 above.
    This might make the issue harder to hit. Hence, for reliable replication, I used
    the below patch to temporarily allow dioread_nolock with nodelalloc and then
    mount the disk with -o nodealloc,dioread_nolock. With this you can hit the stale
    data issue 100% of times:

    @@ -508,8 +508,8 @@ static inline int ext4_should_dioread_nolock(struct inode *inode)
      if (ext4_should_journal_data(inode))
        return 0;
      /* temporary fix to prevent generic/422 test failures */
    - if (!test_opt(inode->i_sb, DELALLOC))
    -   return 0;
    + // if (!test_opt(inode->i_sb, DELALLOC))
    + //  return 0;
      return 1;
     }

    After applying this patch to mark buffer as NEW, both the above issues are
    fixed.

    Signed-off-by: Ojaswin Mujoo <[email protected]>
    Cc: [email protected]
    Reviewed-by: Jan Kara <[email protected]>
    Reviewed-by: "Ritesh Harjani (IBM)" <[email protected]>
    Link: https://lore.kernel.org/r/d0ed09d70a9733fbb5349c5c7b125caac186ecdf.1695033645.git.ojaswin@linux.ibm.com
    Signed-off-by: Theodore Ts'o <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f0cc1368fafd2542f09d18a75aa32288bc49d11b
Author: Kemeng Shi <[email protected]>
Date:   Sun Aug 27 01:47:00 2023 +0800

    ext4: correct offset of gdb backup in non meta_bg group to update_backups

    commit 31f13421c004a420c0e9d288859c9ea9259ea0cc upstream.

    Commit 0aeaa2559d6d5 ("ext4: fix corruption when online resizing a 1K
    bigalloc fs") found that primary superblock's offset in its group is
    not equal to offset of backup superblock in its group when block size
    is 1K and bigalloc is enabled. As group descriptor blocks are right
    after superblock, we can't pass block number of gdb to update_backups
    for the same reason.

    The root casue of the issue above is that leading 1K padding block is
    count as data block offset for primary block while backup block has no
    padding block offset in its group.

    Remove padding data block count to fix the issue for gdb backups.

    For meta_bg case, update_backups treat blk_off as block number, do no
    conversion in this case.

    Signed-off-by: Kemeng Shi <[email protected]>
    Reviewed-by: Theodore Ts'o <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Cc: [email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit af075d06b34f79476bcd4e2b07c8632d206dad78
Author: Max Kellermann <[email protected]>
Date:   Tue Sep 19 10:18:23 2023 +0200

    ext4: apply umask if ACL support is disabled

    commit 484fd6c1de13b336806a967908a927cc0356e312 upstream.

    The function ext4_init_acl() calls posix_acl_create() which is
    responsible for applying the umask.  But without
    CONFIG_EXT4_FS_POSIX_ACL, ext4_init_acl() is an empty inline function,
    and nobody applies the umask.

    This fixes a bug which causes the umask to be ignored with O_TMPFILE
    on ext4:

     https://github.com/MusicPlayerDaemon/MPD/issues/558
     https://bugs.gentoo.org/show_bug.cgi?id=686142#c3
     https://bugzilla.kernel.org/show_bug.cgi?id=203625

    Reviewed-by: "J. Bruce Fields" <[email protected]>
    Cc: [email protected]
    Signed-off-by: Max Kellermann <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Theodore Ts'o <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit e795a56654fd6078cc6c8f88d6debebf511c21ae
Author: Heiner Kallweit <[email protected]>
Date:   Tue Nov 21 09:09:33 2023 +0100

    Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"

    commit 6a26310273c323380da21eb23fcfd50e31140913 upstream.

    This reverts commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df.

    I couldn't reproduce the reported issue. What I did, based on a pcap
    packet log provided by the reporter:
    - Used same chip version (RTL8168h)
    - Set MAC address to the one used on the reporters system
    - Replayed the EAPOL unicast packet that, according to the reporter,
      was filtered out by the mc filter.
    The packet was properly received.

    Therefore the root cause of the reported issue seems to be somewhere
    else. Disabling mc filtering completely for the most common chip
    version is a quite big hammer. Therefore revert the change and wait
    for further analysis results from the reporter.

    Cc: [email protected]
    Signed-off-by: Heiner Kallweit <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit eb2f435be2c46eea47f60baca419b69f01abf6ad
Author: Andrey Konovalov <[email protected]>
Date:   Wed Aug 30 16:16:15 2023 +0100

    media: qcom: camss: Fix csid-gen2 for test pattern generator

    commit 87889f1b7ea40d2544b49c62092e6ef2792dced7 upstream.

    In the current driver csid Test Pattern Generator (TPG) doesn't work.
    This change:
    - fixes writing frame width and height values into CSID_TPG_DT_n_CFG_0
    - fixes the shift by one between test_pattern control value and the
      actual pattern.
    - drops fixed VC of 0x0a which testing showed prohibited some test
      patterns in the CSID to produce output.
    So that TPG starts working, but with the below limitations:
    - only test_pattern=9 works as it should
    - test_pattern=8 and test_pattern=7 produce black frame (all zeroes)
    - the rest of test_pattern's don't work (yavta doesn't get the data)
    - regardless of the CFA pattern set by 'media-ctl -V' the actual pixel
      order is always the same (RGGB for any RAW8 or RAW10P format in
      4608x2592 resolution).

    Tested with:

    RAW10P format, VC0:
     media-ctl -V '"msm_csid0":0[fmt:SRGGB10/4608x2592 field:none]'
     media-ctl -V '"msm_vfe0_rdi0":0[fmt:SRGGB10/4608x2592 field:none]'
     media-ctl -l '"msm_csid0":1->"msm_vfe0_rdi0":0[1]'
     v4l2-ctl -d /dev/v4l-subdev6 -c test_pattern=9
     yavta -B capture-mplane --capture=3 -n 3 -f SRGGB10P -s 4608x2592 /dev/video0

    RAW10P format, VC1:
     media-ctl -V '"msm_csid0":2[fmt:SRGGB10/4608x2592 field:none]'
     media-ctl -V '"msm_vfe0_rdi1":0[fmt:SRGGB10/4608x2592 field:none]'
     media-ctl -l '"msm_csid0":2->"msm_vfe0_rdi1":0[1]'
     v4l2-ctl -d /dev/v4l-subdev6 -c test_pattern=9
     yavta -B capture-mplane --capture=3 -n 3 -f SRGGB10P -s 4608x2592 /dev/video1

    RAW8 format, VC0:
     media-ctl --reset
     media-ctl -V '"msm_csid0":0[fmt:SRGGB8/4608x2592 field:none]'
     media-ctl -V '"msm_vfe0_rdi0":0[fmt:SRGGB8/4608x2592 field:none]'
     media-ctl -l '"msm_csid0":1->"msm_vfe0_rdi0":0[1]'
     yavta -B capture-mplane --capture=3 -n 3 -f SRGGB8 -s 4608x2592 /dev/video0

    Fixes: eebe6d00e9bf ("media: camss: Add support for CSID hardware version Titan 170")
    Cc: [email protected]
    Signed-off-by: Andrey Konovalov <[email protected]>
    Signed-off-by: Bryan O'Donoghue <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit eeab07ddd020e6990ba55b47721348beab5dcaaf
Author: Bryan O'Donoghue <[email protected]>
Date:   Wed Aug 30 16:16:13 2023 +0100

    media: qcom: camss: Fix invalid clock enable bit disjunction

    commit d8f7e1a60d01739a1d78db2b08603089c6cf7c8e upstream.

    define CSIPHY_3PH_CMN_CSI_COMMON_CTRL5_CLK_ENABLE BIT(7)

    disjunction for gen2 ? BIT(7) : is a nop we are setting the same bit
    either way.

    Fixes: 4abb21309fda ("media: camss: csiphy: Move to hardcode CSI Clock Lane number")
    Cc: [email protected]
    Signed-off-by: Bryan O'Donoghue <[email protected]>
    Reviewed-by: Konrad Dybcio <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 18a06f2eeb841185336da7fd3fd5dfd239f23014
Author: Bryan O'Donoghue <[email protected]>
Date:   Wed Aug 30 16:16:12 2023 +0100

    media: qcom: camss: Fix missing vfe_lite clocks check

    commit b6e1bdca463a932c1ac02caa7d3e14bf39288e0c upstream.

    check_clock doesn't account for vfe_lite which means that vfe_lite will
    never get validated by this routine. Add the clock name to the expected set
    to remediate.

    Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
    Cc: [email protected]
    Signed-off-by: Bryan O'Donoghue <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ddc424aedbd379f277870db20883d38d34639e5a
Author: Bryan O'Donoghue <[email protected]>
Date:   Wed Aug 30 16:16:11 2023 +0100

    media: qcom: camss: Fix VFE-480 vfe_disable_output()

    commit 7f24d291350426d40b36dfbe6b3090617cdfd37a upstream.

    vfe-480 is copied from vfe-17x and has the same racy idle timeout bug as in
    17x.

    Fix the vfe_disable_output() logic to no longer be racy and to conform
    to the 17x way of quiescing and then resetting the VFE.

    Fixes: 4edc8eae715c ("media: camss: Add initial support for VFE hardware version Titan 480")
    Cc: [email protected]
    Signed-off-by: Bryan O'Donoghue <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 0f3e5f93fe77bc16e632686b7571d296f91a76be
Author: Bryan O'Donoghue <[email protected]>
Date:   Wed Aug 30 16:16:10 2023 +0100

    media: qcom: camss: Fix VFE-17x vfe_disable_output()

    commit 3143ad282fc08bf995ee73e32a9e40c527bf265d upstream.

    There are two problems with the current vfe_disable_output() routine.

    Firstly we rightly use a spinlock to protect output->gen2.active_num
    everywhere except for in the IDLE timeout path of vfe_disable_output().
    Even if that is not racy "in practice" somehow it is by happenstance not
    by design.

    Secondly we do not get consistent behaviour from this routine. On
    sc8280xp 50% of the time I get "VFE idle timeout - resetting". In this
    case the subsequent capture will succeed. The other 50% of the time, we
    don't hit the idle timeout, never do the VFE reset and subsequent
    captures stall indefinitely.

    Rewrite the vfe_disable_output() routine to

    - Quiesce write masters with vfe_wm_stop()
    - Set active_num = 0

    remembering to hold the spinlock when we do so followed by

    - Reset the VFE

    Testing on sc8280xp and sdm845 shows this to be a valid fix.

    Fixes: 7319cdf189bb ("media: camss: Add support for VFE hardware version Titan 170")
    Cc: [email protected]
    Signed-off-by: Bryan O'Donoghue <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 04ef31a3e38ad207aee87d8a89290152b9000074
Author: Bryan O'Donoghue <[email protected]>
Date:   Wed Aug 30 16:16:09 2023 +0100

    media: qcom: camss: Fix vfe_get() error jump

    commit 26bda3da00c3edef727a6acb00ed2eb4b22f8723 upstream.

    Right now it is possible to do a vfe_get() with the internal reference
    count at 1. If vfe_check_clock_rates() returns non-zero then we will
    leave the reference count as-is and

    run:
    - pm_runtime_put_sync()
    - vfe->ops->pm_domain_off()

    skip:
    - camss_disable_clocks()

    Subsequent vfe_put() calls will when the ref-count is non-zero
    unconditionally run:

    - pm_runtime_put_sync()
    - vfe->ops->pm_domain_off()
    - camss_disable_clocks()

    vfe_get() should not attempt to roll-back on error when the ref-count is
    non-zero as the upper layers will still do their own vfe_put() operations.

    vfe_put() will drop the reference count and do the necessary power
    domain release, the cleanup jumps in vfe_get() should only be run when
    the ref-count is zero.

    [   50.095796] CPU: 7 PID: 3075 Comm: cam Not tainted 6.3.2+ #80
    [   50.095798] Hardware name: LENOVO 21BXCTO1WW/21BXCTO1WW, BIOS N3HET82W (1.54 ) 05/26/2023
    [   50.095799] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    [   50.095802] pc : refcount_warn_saturate+0xf4/0x148
    [   50.095804] lr : refcount_warn_saturate+0xf4/0x148
    [   50.095805] sp : ffff80000c7cb8b0
    [   50.095806] x29: ffff80000c7cb8b0 x28: ffff16ecc0e3fc10 x27: 0000000000000000
    [   50.095810] x26: 0000000000000000 x25: 0000000000020802 x24: 0000000000000000
    [   50.095813] x23: ffff16ecc7360640 x22: 00000000ffffffff x21: 0000000000000005
    [   50.095815] x20: ffff16ed175f4400 x19: ffffb4d9852942a8 x18: ffffffffffffffff
    [   50.095818] x17: ffffb4d9852d4a48 x16: ffffb4d983da5db8 x15: ffff80000c7cb320
    [   50.095821] x14: 0000000000000001 x13: 2e656572662d7265 x12: 7466612d65737520
    [   50.095823] x11: 00000000ffffefff x10: ffffb4d9850cebf0 x9 : ffffb4d9835cf954
    [   50.095826] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000057fa8
    [   50.095829] x5 : ffff16f813fe3d08 x4 : 0000000000000000 x3 : ffff621e8f4d2000
    [   50.095832] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff16ed32119040
    [   50.095835] Call trace:
    [   50.095836]  refcount_warn_saturate+0xf4/0x148
    [   50.095838]  device_link_put_kref+0x84/0xc8
    [   50.095843]  device_link_del+0x38/0x58
    [   50.095846]  vfe_pm_domain_off+0x3c/0x50 [qcom_camss]
    [   50.095860]  vfe_put+0x114/0x140 [qcom_camss]
    [   50.095869]  csid_set_power+0x2c8/0x408 [qcom_camss]
    [   50.095878]  pipeline_pm_power_one+0x164/0x170 [videodev]
    [   50.095896]  pipeline_pm_power+0xc4/0x110 [videodev]
    [   50.095909]  v4l2_pipeline_pm_use+0x5c/0xa0 [videodev]
    [   50.095923]  v4l2_pipeline_pm_get+0x1c/0x30 [videodev]
    [   50.095937]  video_open+0x7c/0x100 [qcom_camss]
    [   50.095945]  v4l2_open+0x84/0x130 [videodev]
    [   50.095960]  chrdev_open+0xc8/0x250
    [   50.095964]  do_dentry_open+0x1bc/0x498
    [   50.095966]  vfs_open+0x34/0x40
    [   50.095968]  path_openat+0xb44/0xf20
    [   50.095971]  do_filp_open+0xa4/0x160
    [   50.095974]  do_sys_openat2+0xc8/0x188
    [   50.095975]  __arm64_sys_openat+0x6c/0xb8
    [   50.095977]  invoke_syscall+0x50/0x128
    [   50.095982]  el0_svc_common.constprop.0+0x4c/0x100
    [   50.095985]  do_el0_svc+0x40/0xa8
    [   50.095988]  el0_svc+0x2c/0x88
    [   50.095991]  el0t_64_sync_handler+0xf4/0x120
    [   50.095994]  el0t_64_sync+0x190/0x198
    [   50.095996] ---[ end trace 0000000000000000 ]---

    Fixes: 779096916dae ("media: camss: vfe: Fix runtime PM imbalance on error")
    Cc: [email protected]
    Signed-off-by: Bryan O'Donoghue <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 3166c3af55fe197f332d7cd83982e8b06dba5bd4
Author: Bryan O'Donoghue <[email protected]>
Date:   Wed Aug 30 16:16:06 2023 +0100

    media: qcom: camss: Fix pm_domain_on sequence in probe

    commit 7405116519ad70b8c7340359bfac8db8279e7ce4 upstream.

    We need to make sure camss_configure_pd() happens before
    camss_register_entities() as the vfe_get() path relies on the pointer
    provided by camss_configure_pd().

    Fix the ordering sequence in probe to ensure the pointers vfe_get() demands
    are present by the time camss_register_entities() runs.

    In order to facilitate backporting to stable kernels I've moved the
    configure_pd() call pretty early on the probe() function so that
    irrespective of the existence of the old error handling jump labels this
    patch should still apply to -next circa Aug 2023 to v5.13 inclusive.

    Fixes: 2f6f8af67203 ("media: camss: Refactor VFE power domain toggling")
    Cc: [email protected]
    Signed-off-by: Bryan O'Donoghue <[email protected]>
    Reviewed-by: Laurent Pinchart <[email protected]>
    Signed-off-by: Hans Verkuil <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 6dcb2605c284fbd54963547ab4df1c91e591a959
Author: Victor Shih <[email protected]>
Date:   Tue Nov 7 17:57:40 2023 +0800

    mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER

    commit 015c9cbcf0ad709079117d27c2094a46e0eadcdb upstream.

    Due to a flaw in the hardware design, the GL9750 replay timer frequently
    times out when ASPM is enabled. As a result, the warning messages will
    often appear in the system log when the system accesses the GL9750
    PCI config. Therefore, the replay timer timeout must be masked.

    Fixes: d7133797e9e1 ("mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2")
    Signed-off-by: Victor Shih <[email protected]>
    Acked-by: Adrian Hunter <[email protected]>
    Acked-by: Kai-Heng Feng <[email protected]>
    Cc: [email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit f7164cb0371f194bb1ce6309897b58f6ad7e32b5
Author: ChunHao Lin <[email protected]>
Date:   Fri Nov 10 01:33:59 2023 +0800

    r8169: add handling DASH when DASH is disabled

    commit 0ab0c45d8aaea5192328bfa6989673aceafc767c upstream.

    For devices that support DASH, even DASH is disabled, there may still
    exist a default firmware that will influence device behavior.
    So driver needs to handle DASH for devices that support DASH, no
    matter the DASH status is.

    This patch also prepares for "fix network lost after resume on DASH
    systems".

    Fixes: ee7a1beb9759 ("r8169:call "rtl8168_driver_start" "rtl8168_driver_stop" only when hardware dash function is enabled")
    Cc: [email protected]
    Signed-off-by: ChunHao Lin <[email protected]>
    Reviewed-by: Heiner Kallweit <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 862565f32494c7e8d88f49a02989c792c3926841
Author: ChunHao Lin <[email protected]>
Date:   Fri Nov 10 01:34:00 2023 +0800

    r8169: fix network lost after resume on DASH systems

    commit 868c3b95afef4883bfb66c9397482da6840b5baf upstream.

    Device that support DASH may be reseted or powered off during suspend.
    So driver needs to handle DASH during system suspend and resume. Or
    DASH firmware will influence device behavior and causes network lost.

    Fixes: b646d90053f8 ("r8169: magic.")
    Cc: [email protected]
    Reviewed-by: Heiner Kallweit <[email protected]>
    Signed-off-by: ChunHao Lin <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 9e9e2107ae3637ed143d87f86025b47ddb502060
Author: Paolo Abeni <[email protected]>
Date:   Tue Nov 14 00:16:16 2023 +0100

    mptcp: fix setsockopt(IP_TOS) subflow locking

    commit 7679d34f97b7a09fd565f5729f79fd61b7c55329 upstream.

    The MPTCP implementation of the IP_TOS socket option uses the lockless
    variant of the TOS manipulation helper and does not hold such lock at
    the helper invocation time.

    Add the required locking.

    Fixes: ffcacff87cd6 ("mptcp: Support for IP_TOS for MPTCP setsockopt()")
    Cc: [email protected]
    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/457
    Signed-off-by: Paolo Abeni <[email protected]>
    Reviewed-by: Mat Martineau <[email protected]>
    Signed-off-by: Matthieu Baerts <[email protected]>
    Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-4-7b9cd6a7b7f4@kernel.org
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit dba6f08cef1944116be7a480a4f8e51faca2a184
Author: Geliang Tang <[email protected]>
Date:   Tue Nov 14 00:16:15 2023 +0100

    mptcp: add validity check for sending RM_ADDR

    commit 8df220b29282e8b450ea57be62e1eccd4996837c upstream.

    This patch adds the validity check for sending RM_ADDRs for userspace PM
    in mptcp_pm_remove_addrs(), only send a RM_ADDR when the address is in the
    anno_list or conn_list.

    Fixes: 8b1c94da1e48 ("mptcp: only send RM_ADDR in nl_cmd_remove")
    Cc: [email protected]
    Signed-off-by: Geliang Tang <[email protected]>
    Reviewed-by: Mat Martineau <[email protected]>
    Signed-off-by: Matthieu Baerts <[email protected]>
    Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-3-7b9cd6a7b7f4@kernel.org
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 70ff9b65a72885b3a2dfde6709da1f19b85fa696
Author: Paolo Abeni <[email protected]>
Date:   Tue Nov 14 00:16:13 2023 +0100

    mptcp: deal with large GSO size

    commit 9fce92f050f448a0d1ddd9083ef967d9930f1e52 upstream.

    After the blamed commit below, the TCP sockets (and the MPTCP subflows)
    can build egress packets larger than 64K. That exceeds the maximum DSS
    data size, the length being misrepresent on the wire and the stream being
    corrupted, as later observed on the receiver:

      WARNING: CPU: 0 PID: 9696 at net/mptcp/protocol.c:705 __mptcp_move_skbs_from_subflow+0x2604/0x26e0
      CPU: 0 PID: 9696 Comm: syz-executor.7 Not tainted 6.6.0-rc5-gcd8bdf563d46 #45
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
      netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
      RIP: 0010:__mptcp_move_skbs_from_subflow+0x2604/0x26e0 net/mptcp/protocol.c:705
      RSP: 0018:ffffc90000006e80 EFLAGS: 00010246
      RAX: ffffffff83e9f674 RBX: ffff88802f45d870 RCX: ffff888102ad0000
      netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
      RDX: 0000000080000303 RSI: 0000000000013908 RDI: 0000000000003908
      RBP: ffffc90000007110 R08: ffffffff83e9e078 R09: 1ffff1100e548c8a
      R10: dffffc0000000000 R11: ffffed100e548c8b R12: 0000000000013908
      R13: dffffc0000000000 R14: 0000000000003908 R15: 000000000031cf29
      FS:  00007f239c47e700(0000) GS:ffff88811b200000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f239c45cd78 CR3: 000000006a66c006 CR4: 0000000000770ef0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
      PKRU: 55555554
      Call Trace:
       <IRQ>
       mptcp_data_ready+0x263/0xac0 net/mptcp/protocol.c:819
       subflow_data_ready+0x268/0x6d0 net/mptcp/subflow.c:1409
       tcp_data_queue+0x21a1/0x7a60 net/ipv4/tcp_input.c:5151
       tcp_rcv_established+0x950/0x1d90 net/ipv4/tcp_input.c:6098
       tcp_v6_do_rcv+0x554/0x12f0 net/ipv6/tcp_ipv6.c:1483
       tcp_v6_rcv+0x2e26/0x3810 net/ipv6/tcp_ipv6.c:1749
       ip6_protocol_deliver_rcu+0xd6b/0x1ae0 net/ipv6/ip6_input.c:438
       ip6_input+0x1c5/0x470 net/ipv6/ip6_input.c:483
       ipv6_rcv+0xef/0x2c0 include/linux/netfilter.h:304
       __netif_receive_skb+0x1ea/0x6a0 net/core/dev.c:5532
       process_backlog+0x353/0x660 net/core/dev.c:5974
       __napi_poll+0xc6/0x5a0 net/core/dev.c:6536
       net_rx_action+0x6a0/0xfd0 net/core/dev.c:6603
       __do_softirq+0x184/0x524 kernel/softirq.c:553
       do_softirq+0xdd/0x130 kernel/softirq.c:454

    Address the issue explicitly bounding the maximum GSO size to what MPTCP
    actually allows.

    Reported-by: Christoph Paasch <[email protected]>
    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/450
    Fixes: 7c4e983c4f3c ("net: allow gso_max_size to exceed 65536")
    Cc: [email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Reviewed-by: Mat Martineau <[email protected]>
    Signed-off-by: Matthieu Baerts <[email protected]>
    Link: https://lore.kernel.org/r/20231114-upstream-net-20231113-mptcp-misc-fixes-6-7-rc2-v1-1-7b9cd6a7b7f4@kernel.org
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 16fcda24b17507f2bb584e14dec5285301528f52
Author: Roman Gushchin <[email protected]>
Date:   Tue Nov 7 09:18:02 2023 -0800

    mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors

    commit 24948e3b7b12e0031a6edb4f49bbb9fb2ad1e4e9 upstream.

    Objcg vectors attached to slab pages to store slab object ownership
    information are allocated using gfp flags for the original slab
    allocation.  Depending on slab page order and the size of slab objects,
    objcg vector can take several pages.

    If the original allocation was done with the __GFP_NOFAIL flag, it
    triggered a warning in the page allocation code.  Indeed, order > 1 pages
    should not been allocated with the __GFP_NOFAIL flag.

    Fix this by simply dropping the __GFP_NOFAIL flag when allocating the
    objcg vector.  It effectively allows to skip the accounting of a single
    slab object under a heavy memory pressure.

    An alternative would be to implement the mechanism to fallback to order-0
    allocations for accounting metadata, which is also not perfect because it
    will increase performance penalty and memory footprint of the kernel
    memory accounting under memory pressure.

    Link: https://lkml.kernel.org/r/[email protected]
    Signed-off-by: Roman Gushchin <[email protected]>
    Reported-by: Christoph Lameter <[email protected]>
    Closes: https://lkml.kernel.org/r/[email protected]
    Acked-by: Shakeel Butt <[email protected]>
    Cc: Matthew Wilcox <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit a7fd033550271895e2a87ffc8303a03ffdeb9096
Author: Stefan Roesch <[email protected]>
Date:   Mon Nov 6 10:19:18 2023 -0800

    mm: fix for negative counter: nr_file_hugepages

    commit a48d5bdc877b85201e42cef9c2fdf5378164c23a upstream.

    While qualifiying the 6.4 release, the following warning was detected in
    messages:

    vmstat_refresh: nr_file_hugepages -15664

    The warning is caused by the incorrect updating of the NR_FILE_THPS
    counter in the function split_huge_page_to_list.  The if case is checking
    for folio_test_swapbacked, but the else case is missing the check for
    folio_test_pmd_mappable.  The other functions that manipulate the counter
    like __filemap_add_folio and filemap_unaccount_folio have the
    corresponding check.

    I have a test case, which reproduces the problem. It can be found here:
      https://github.com/sroeschus/testcase/blob/main/vmstat_refresh/madv.c

    The test case reproduces on an XFS filesystem. Running the same test
    case on a BTRFS filesystem does not reproduce the problem.

    AFAIK version 6.1 until 6.6 are affected by this problem.

    [[email protected]: whitespace fix]
    [[email protected]: test for folio_test_pmd_mappable()]
      Link: https://lkml.kernel.org/r/[email protected]
    Link: https://lkml.kernel.org/r/[email protected]
    Signed-off-by: Stefan Roesch <[email protected]>
    Co-debugged-by: Johannes Weiner <[email protected]>
    Acked-by: Johannes Weiner <[email protected]>
    Reviewed-by: Matthew Wilcox (Oracle) <[email protected]>
    Reviewed-by: David Hildenbrand <[email protected]>
    Reviewed-by: Yang Shi <[email protected]>
    Cc: Rik van Riel <[email protected]>
    Cc: <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 2594bdaa16b47d304cbe3f3438632b7175b3d747
Author: Victor Shih <[email protected]>
Date:   Tue Sep 12 17:17:10 2023 +0800

    mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2

    commit d7133797e9e1b72fd89237f68cb36d745599ed86 upstream.

    When GL9750 enters ASPM L1 sub-states, it will stay at L1.1 and will not
    enter L1.2. The workaround is to toggle PM state to allow GL9750 to enter
    ASPM L1.2.

    Signed-off-by: Victor Shih <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 97fb6013f318d77077413376d61691e930c2226c
Author: Nam Cao <[email protected]>
Date:   Tue Aug 29 20:25:00 2023 +0200

    riscv: kprobes: allow writing to x0

    commit 8cb22bec142624d21bc85ff96b7bad10b6220e6a upstream.

    Instructions can write to x0, so we should simulate these instructions
    normally.

    Currently, the kernel hangs if an instruction who writes to x0 is
    simulated.

    Fixes: c22b0bcb1dd0 ("riscv: Add kprobes supported")
    Cc: [email protected]
    Signed-off-by: Nam Cao <[email protected]>
    Reviewed-by: Charlie Jenkins <[email protected]>
    Acked-by: Guo Ren <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Palmer Dabbelt <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 645257ad8d307f7f11984a1e7ca713349ef12944
Author: Song Shuai <[email protected]>
Date:   Tue Aug 29 21:39:20 2023 -0700

    riscv: correct pt_level name via pgtable_l5/4_enabled

    commit e59e5e2754bf983fc58ad18f99b5eec01f1a0745 upstream.

    The pt_level uses CONFIG_PGTABLE_LEVELS to display page table names.
    But if page mode is downgraded from kernel cmdline or restricted by
    the hardware in 64BIT, it will give a wrong name.

    Like, using no4lvl for sv39, ptdump named the 1G-mapping as "PUD"
    that should be "PGD":

    0xffffffd840000000-0xffffffd900000000    0x00000000c0000000         3G PUD     D A G . . W R V

    So select "P4D/PUD" or "PGD" via pgtable_l5/4_enabled to correct it.

    Fixes: e8a62cc26ddf ("riscv: Implement sv48 support")
    Reviewed-by: Alexandre Ghiti <[email protected]>
    Signed-off-by: Song Shuai <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Cc: [email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Palmer Dabbelt <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit fb1b16f04135b50a577370f3ac00f7e8e402a3bd
Author: Song Shuai <[email protected]>
Date:   Wed Aug 9 11:10:23 2023 +0800

    riscv: mm: Update the comment of CONFIG_PAGE_OFFSET

    commit 559fe94a449cba5b50a7cffea60474b385598c00 upstream.

    Since the commit 011f09d12052 set sv57 as default for CONFIG_64BIT,
    the comment of CONFIG_PAGE_OFFSET should be updated too.

    Fixes: 011f09d12052 ("riscv: mm: Set sv57 on defaultly")
    Signed-off-by: Song Shuai <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Cc: [email protected]
    Signed-off-by: Palmer Dabbelt <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 9f74b261e4e2c39168b3e10743b9e606b2521422
Author: Nathan Chancellor <[email protected]>
Date:   Wed Nov 8 14:12:15 2023 +0800

    LoongArch: Mark __percpu functions as always inline

    commit 71945968d8b128c955204baa33ec03bdd91bdc26 upstream.

    A recent change to the optimization pipeline in LLVM reveals some
    fragility around the inlining of LoongArch's __percpu functions, which
    manifests as a BUILD_BUG() failure:

      In file included from kernel/sched/build_policy.c:17:
      In file included from include/linux/sched/cputime.h:5:
      In file included from include/linux/sched/signal.h:5:
      In file included from include/linux/rculist.h:11:
      In file included from include/linux/rcupdate.h:26:
      In file included from include/linux/irqflags.h:18:
      arch/loongarch/include/asm/percpu.h:97:3: error: call to '__compiletime_assert_51' declared with 'error' attribute: BUILD_BUG failed
         97 |                 BUILD_BUG();
            |                 ^
      include/linux/build_bug.h:59:21: note: expanded from macro 'BUILD_BUG'
         59 | #define BUILD_BUG() BUILD_BUG_ON_MSG(1, "BUILD_BUG failed")
            |                     ^
      include/linux/build_bug.h:39:37: note: expanded from macro 'BUILD_BUG_ON_MSG'
         39 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
            |                                     ^
      include/linux/compiler_types.h:425:2: note: expanded from macro 'compiletime_assert'
        425 |         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
            |         ^
      include/linux/compiler_types.h:413:2: note: expanded from macro '_compiletime_assert'
        413 |         __compiletime_assert(condition, msg, prefix, suffix)
            |         ^
      include/linux/compiler_types.h:406:4: note: expanded from macro '__compiletime_assert'
        406 |                         prefix ## suffix();                             \
            |                         ^
      <scratch space>:86:1: note: expanded from here
         86 | __compiletime_assert_51
            | ^
      1 error generated.

    If these functions are not inlined (which the compiler is free to do
    even with functions marked with the standard 'inline' keyword), the
    BUILD_BUG() in the default case cannot be eliminated since the compiler
    cannot prove it is never used, resulting in a build failure due to the
    error attribute.

    Mark these functions as __always_inline to guarantee inlining so that
    the BUILD_BUG() only triggers when the default case genuinely cannot be
    eliminated due to an unexpected size.

    Cc:  <[email protected]>
    Closes: https://github.com/ClangBuiltLinux/linux/…
fozog pushed a commit to fozog/linux that referenced this pull request Nov 30, 2023
@reddysujith @fozog
ASoC: SOF: amd: Fix for handling spurious interrupts from DSP
f55cb6b 
As interrupts are Level-triggered,unless and until we deassert the register
the interrupts are generated which causes spurious interrupts unhandled.

Now we deasserted the interrupt at top half which solved the below
"nobody cared" warning.

warning reported in dmesg:
	irq 80: nobody cared (try booting with the "irqpoll" option)
	CPU: 5 PID: 2735 Comm: irq/80-AudioDSP
		Not tainted 5.15.86-15817-g4c19f3e06d49 #1 1bd3fd932cf58caacc95b0504d6ea1e3eab22289
	Hardware name: Google Skyrim/Skyrim, BIOS Google_Skyrim.15303.0.0 01/03/2023
	Call Trace:
	<IRQ>
	dump_stack_lvl+0x69/0x97
	 __report_bad_irq+0x3a/0xae
	note_interrupt+0x1a9/0x1e3
	handle_irq_event_percpu+0x4b/0x6e
	handle_irq_event+0x36/0x5b
	handle_fasteoi_irq+0xae/0x171
	 __common_interrupt+0x48/0xc4
	</IRQ>

	handlers:
	acp_irq_handler [snd_sof_amd_acp] threaded [<000000007e089f34>] acp_irq_thread [snd_sof_amd_acp]
	Disabling IRQ torvalds#80

Signed-off-by: V sujith kumar Reddy <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Mark Brown <[email protected]>
mj22226 pushed a commit to mj22226/linux that referenced this pull request Dec 5, 2023
@zhengchaoshao @gregkh
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
45925a1 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
mj22226 pushed a commit to mj22226/linux that referenced this pull request Dec 5, 2023
@zhengchaoshao @gregkh
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
1fdf160 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
intersectRaven pushed a commit to intersectRaven/linux that referenced this pull request Dec 8, 2023
@zhengchaoshao @gregkh
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
bf8601d 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Dec 8, 2023
@zhengchaoshao @gregkh
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
94445d9 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Dec 8, 2023
@zhengchaoshao @gregkh
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
be70b32 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Dec 8, 2023
@zhengchaoshao @gregkh
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
6b6f5c6 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Dec 8, 2023
@zhengchaoshao @gregkh
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
7ccf772 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Dec 8, 2023
@zhengchaoshao @gregkh
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
772fe1d 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
1054009064 pushed a commit to 1054009064/linux that referenced this pull request Dec 8, 2023
@zhengchaoshao @gregkh
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
c4a00c4 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
Relms12345 added a commit to Relms12345/linux that referenced this pull request Dec 10, 2023
@Relms12345
Squash tag "v6.1.66" from linux-stable
c7f5fc6 
commit 6c6a6c7e211cc02943dcb8c073919d2105054886
Author: Greg Kroah-Hartman <[email protected]>
Date:   Fri Dec 8 08:51:20 2023 +0100

    Linux 6.1.66

    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Jon Hunter <[email protected]>
    Tested-by: Salvatore Bonaccorso <[email protected]>
    Tested-by: SeongJae Park <[email protected]>
    Tested-by: Florian Fainelli <[email protected]>
    Tested-by: Shuah Khan <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Tested-by: Pavel Machek (CIP) <[email protected]>
    Tested-by: Florian Fainelli <[email protected]>
    Tested-by: Allen Pais <[email protected]>
    Tested-by: Ron Economos <[email protected]>
    Tested-by: Linux Kernel Functional Testing <[email protected]>
    Tested-by: Jon Hunter <[email protected]>
    Tested-by: Guenter Roeck <[email protected]>
    Tested-by: Conor Dooley <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit ea574927fc0bc343016ea3337fcfc0b3fb26fe08
Author: Christoph Hellwig <[email protected]>
Date:   Thu Jun 1 16:58:54 2023 +0200

    iomap: update ki_pos a little later in iomap_dio_complete

    commit 936e114a245b6e38e0dbf706a67e7611fc993da1 upstream.

    Move the ki_pos update down a bit to prepare for a better common helper
    that invalidates pages based of an iocb.

    Link: https://lkml.kernel.org/r/[email protected]
    Signed-off-by: Christoph Hellwig <[email protected]>
    Reviewed-by: Damien Le Moal <[email protected]>
    Reviewed-by: Hannes Reinecke <[email protected]>
    Reviewed-by: Darrick J. Wong <[email protected]>
    Cc: Al Viro <[email protected]>
    Cc: Andreas Gruenbacher <[email protected]>
    Cc: Anna Schumaker <[email protected]>
    Cc: Chao Yu <[email protected]>
    Cc: Christian Brauner <[email protected]>
    Cc: Ilya Dryomov <[email protected]>
    Cc: Jaegeuk Kim <[email protected]>
    Cc: Jens Axboe <[email protected]>
    Cc: Johannes Thumshirn <[email protected]>
    Cc: Matthew Wilcox <[email protected]>
    Cc: Miklos Szeredi <[email protected]>
    Cc: Miklos Szeredi <[email protected]>
    Cc: Theodore Ts'o <[email protected]>
    Cc: Trond Myklebust <[email protected]>
    Cc: Xiubo Li <[email protected]>
    Signed-off-by: Andrew Morton <[email protected]>
    Cc: Jan Kara <[email protected]>
    Link: https://lore.kernel.org/r/20231205122122.dfhhoaswsfscuhc3@quack3
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit adf0ecebf00a2aab8b089c6f2f24d2cea983f90e
Author: Koichiro Den <[email protected]>
Date:   Thu Oct 26 12:20:36 2023 +0900

    x86/apic/msi: Fix misconfigured non-maskable MSI quirk

    commit b56ebe7c896dc78b5865ec2c4b1dae3c93537517 upstream.

    commit ef8dd01538ea ("genirq/msi: Make interrupt allocation less
    convoluted"), reworked the code so that the x86 specific quirk for affinity
    setting of non-maskable PCI/MSI interrupts is not longer activated if
    necessary.

    This could be solved by restoring the original logic in the core MSI code,
    but after a deeper analysis it turned out that the quirk flag is not
    required at all.

    The quirk is only required when the PCI/MSI device cannot mask the MSI
    interrupts, which in turn also prevents reservation mode from being enabled
    for the affected interrupt.

    This allows ot remove the NOMASK quirk bit completely as msi_set_affinity()
    can instead check whether reservation mode is enabled for the interrupt,
    which gives exactly the same answer.

    Even in the momentary non-existing case that the reservation mode would be
    not set for a maskable MSI interrupt this would not cause any harm as it
    just would cause msi_set_affinity() to go needlessly through the
    functionaly equivalent slow path, which works perfectly fine with maskable
    interrupts as well.

    Rework msi_set_affinity() to query the reservation mode and remove all
    NOMASK quirk logic from the core code.

    [ tglx: Massaged changelog ]

    Fixes: ef8dd01538ea ("genirq/msi: Make interrupt allocation less convoluted")
    Suggested-by: Thomas Gleixner <[email protected]>
    Signed-off-by: Koichiro Den <[email protected]>
    Signed-off-by: Thomas Gleixner <[email protected]>
    Cc: [email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit b3b839fb636b0983a0064d3cb97853962a0ac59e
Author: Juergen Gross <[email protected]>
Date:   Fri Nov 24 08:48:52 2023 +0100

    x86/xen: fix percpu vcpu_info allocation

    [ Upstream commit db2832309a82b9acc4b8cc33a1831d36507ec13e ]

    Today the percpu struct vcpu_info is allocated via DEFINE_PER_CPU(),
    meaning that it could cross a page boundary. In this case registering
    it with the hypervisor will fail, resulting in a panic().

    This can easily be fixed by using DEFINE_PER_CPU_ALIGNED() instead,
    as struct vcpu_info is guaranteed to have a size of 64 bytes, matching
    the cache line size of x86 64-bit processors (Xen doesn't support
    32-bit processors).

    Fixes: 5ead97c84fa7 ("xen: Core Xen implementation")
    Signed-off-by: Juergen Gross <[email protected]>
    Reviewed-by: Boris Ostrovsky <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Juergen Gross <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 00bc8b2cf44cc59c1177a167b2551294c6ed91eb
Author: Juergen Gross <[email protected]>
Date:   Thu Aug 24 17:34:21 2023 +0200

    xen: simplify evtchn_do_upcall() call maze

    [ Upstream commit 37510dd566bdbff31a769cde2fa6654bccdb8b24 ]

    There are several functions involved for performing the functionality
    of evtchn_do_upcall():

    - __xen_evtchn_do_upcall() doing the real work
    - xen_hvm_evtchn_do_upcall() just being a wrapper for
      __xen_evtchn_do_upcall(), exposed for external callers
    - xen_evtchn_do_upcall() calling __xen_evtchn_do_upcall(), too, but
      without any user

    Simplify this maze by:

    - removing the unused xen_evtchn_do_upcall()
    - removing xen_hvm_evtchn_do_upcall() as the only left caller of
      __xen_evtchn_do_upcall(), while renaming __xen_evtchn_do_upcall() to
      xen_evtchn_do_upcall()

    Signed-off-by: Juergen Gross <[email protected]>
    Reviewed-by: Boris Ostrovsky <[email protected]>
    Reviewed-by: Thomas Gleixner <[email protected]>
    Signed-off-by: Juergen Gross <[email protected]>
    Stable-dep-of: db2832309a82 ("x86/xen: fix percpu vcpu_info allocation")
    Signed-off-by: Sasha Levin <[email protected]>

commit 9311a0ff388aa4f05d448edb656f308122694c03
Author: David Woodhouse <[email protected]>
Date:   Wed Jan 18 12:22:38 2023 +0000

    xen: Allow platform PCI interrupt to be shared

    [ Upstream commit 3e8cd711c3da6c3d724076048038cd666bdbb2b5 ]

    When we don't use the per-CPU vector callback, we ask Xen to deliver event
    channel interrupts as INTx on the PCI platform device. As such, it can be
    shared with INTx on other PCI devices.

    Set IRQF_SHARED, and make it return IRQ_HANDLED or IRQ_NONE according to
    whether the evtchn_upcall_pending flag was actually set. Now I can share
    the interrupt:

     11:         82          0   IO-APIC  11-fasteoi   xen-platform-pci, ens4

    Drop the IRQF_TRIGGER_RISING. It has no effect when the IRQ is shared,
    and besides, the only effect it was having even beforehand was to trigger
    a debug message in both I/OAPIC and legacy PIC cases:

    [    0.915441] genirq: No set_type function for IRQ 11 (IO-APIC)
    [    0.951939] genirq: No set_type function for IRQ 11 (XT-PIC)

    Signed-off-by: David Woodhouse <[email protected]>
    Reviewed-by: Juergen Gross <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Juergen Gross <[email protected]>
    Stable-dep-of: db2832309a82 ("x86/xen: fix percpu vcpu_info allocation")
    Signed-off-by: Sasha Levin <[email protected]>

commit 402b8323461caedae0588ced14e58a387bf46d8a
Author: Heiner Kallweit <[email protected]>
Date:   Sun Nov 26 19:36:46 2023 +0100

    r8169: fix deadlock on RTL8125 in jumbo mtu mode

    [ Upstream commit 59d395ed606d8df14615712b0cdcdadb2d962175 ]

    The original change results in a deadlock if jumbo mtu mode is used.
    Reason is that the phydev lock is held when rtl_reset_work() is called
    here, and rtl_jumbo_config() calls phy_start_aneg() which also tries
    to acquire the phydev lock. Fix this by calling rtl_reset_work()
    asynchronously.

    Fixes: 621735f59064 ("r8169: fix rare issue with broken rx after link-down on RTL8125")
    Reported-by: Ian Chen <[email protected]>
    Tested-by: Ian Chen <[email protected]>
    Cc: [email protected]
    Signed-off-by: Heiner Kallweit <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 22ee0ddb2af7ad2adf5f43fc2321735b7ee397ac
Author: Heiner Kallweit <[email protected]>
Date:   Tue Jan 10 23:03:18 2023 +0100

    r8169: disable ASPM in case of tx timeout

    [ Upstream commit 80c0576ef179311f624bc450fede30a89afe9792 ]

    There are still single reports of systems where ASPM incompatibilities
    cause tx timeouts. It's not clear whom to blame, so let's disable
    ASPM in case of a tx timeout.

    v2:
    - add one-time warning for informing the user

    Signed-off-by: Heiner Kallweit <[email protected]>
    Reviewed-by: Alexander Duyck <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Stable-dep-of: 59d395ed606d ("r8169: fix deadlock on RTL8125 in jumbo mtu mode")
    Signed-off-by: Sasha Levin <[email protected]>

commit 10ce6301009fa46ba264ed75b822115ec3ca6e67
Author: Ilya Bakoulin <[email protected]>
Date:   Tue Nov 7 15:07:56 2023 -0500

    drm/amd/display: Fix MPCC 1DLUT programming

    [ Upstream commit 6f395cebdd8927fbffdc3a55a14fcacf93634359 ]

    [Why]
    Wrong function is used to translate LUT values to HW format, leading to
    visible artifacting in some cases.

    [How]
    Use the correct cm3_helper function.

    Cc: [email protected] # 6.1+
    Reviewed-by: Krunoslav Kovac <[email protected]>
    Acked-by: Hamza Mahfooz <[email protected]>
    Signed-off-by: Ilya Bakoulin <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 8332cb6c63394f32117a6f46a8cf7bedb8eec0b1
Author: Harry Wentland <[email protected]>
Date:   Thu Apr 6 18:06:27 2023 -0400

    drm/amd/display: Fix the delta clamping for shaper LUT

    [ Upstream commit 27fc10d1095f7a7de7c917638d7134033a190dd8 ]

    The shaper LUT requires a 10-bit value of the delta between segments. We
    were using dc_fixpt_clamp_u0d10() to do that but it doesn't do what we
    want it to do. It will preserve 10-bit precision after the decimal
    point, but that's not quite what we want. We want 14-bit precision and
    discard the 4 most-significant bytes.

    To do that we'll do dc_fixpt_clamp_u0d14() & 0x3ff instead.

    Tested-by: Daniel Wheeler <[email protected]>
    Reviewed-by: Krunoslav Kovac <[email protected]>
    Acked-by: Rodrigo Siqueira <[email protected]>
    Signed-off-by: Harry Wentland <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Stable-dep-of: 6f395cebdd89 ("drm/amd/display: Fix MPCC 1DLUT programming")
    Signed-off-by: Sasha Levin <[email protected]>

commit 442a4d4d01579d5d7066d0653898ffbb4091e3be
Author: Melissa Wen <[email protected]>
Date:   Tue Feb 14 11:14:02 2023 -0100

    drm/amd/display: clean code-style issues in dcn30_set_mpc_shaper_3dlut

    [ Upstream commit 94369589e4ec13c762fe10a1fdc4463bdfee5d5f ]

    This function has many conditions and all code style issues (identation,
    missing braces, etc.) make reading it really annoying.

    Reviewed-by: Christian König <[email protected]>
    Signed-off-by: Melissa Wen <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Stable-dep-of: 6f395cebdd89 ("drm/amd/display: Fix MPCC 1DLUT programming")
    Signed-off-by: Sasha Levin <[email protected]>

commit 6cd736272165d7a6a7d62fb0a40536ed3741ed02
Author: Rodrigo Siqueira <[email protected]>
Date:   Thu Oct 20 11:46:57 2022 -0400

    drm/amd/display: Expand kernel doc for DC

    [ Upstream commit 1682bd1a6b5fb094e914d9b73b711821fd84dcbd ]

    This commit adds extra documentation for elements related to FAMs.

    Tested-by: Mark Broadworth <[email protected]>
    Reviewed-by: Aurabindo Pillai <[email protected]>
    Acked-by: Rodrigo Siqueira <[email protected]>
    Signed-off-by: Rodrigo Siqueira <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Stable-dep-of: 67e38874b85b ("drm/amd/display: Increase num voltage states to 40")
    Signed-off-by: Sasha Levin <[email protected]>

commit 8b01195be4a98009815ffafd5bf676e3c50ebaf1
Author: Wenchao Chen <[email protected]>
Date:   Wed Nov 15 16:34:06 2023 +0800

    mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled

    [ Upstream commit 477865af60b2117ceaa1d558e03559108c15c78c ]

    With cat regulator_summary, we found that vqmmc was not shutting
    down after the card was pulled.

    cat /sys/kernel/debug/regulator/regulator_summary
    1.before fix
    1)Insert SD card
     vddsdio		1    1  0 unknown  3500mV 0mA  1200mV  3750mV
        71100000.mmc-vqmmc  1                         0mA  3500mV  3600mV

    2)Pull out the SD card
     vddsdio                1    1  0 unknown  3500mV 0mA  1200mV  3750mV
        71100000.mmc-vqmmc  1                         0mA  3500mV  3600mV

    2.after fix
    1)Insert SD cardt
     vddsdio                1    1  0 unknown  3500mV 0mA  1200mV  3750mV
        71100000.mmc-vqmmc  1                         0mA  3500mV  3600mV

    2)Pull out the SD card
     vddsdio		0    1  0 unknown  3500mV 0mA  1200mV  3750mV
        71100000.mmc-vqmmc  0                         0mA  3500mV  3600mV

    Fixes: fb8bd90f83c4 ("mmc: sdhci-sprd: Add Spreadtrum's initial host controller")
    Signed-off-by: Wenchao Chen <[email protected]>
    Cc: [email protected]
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Ulf Hansson <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 38d3216032c95a6dceb4fea829ec63e38250bef1
Author: Heiner Kallweit <[email protected]>
Date:   Sat Mar 11 23:39:55 2023 +0100

    mmc: core: add helpers mmc_regulator_enable/disable_vqmmc

    [ Upstream commit 8d91f3f8ae57e6292142ca89f322e90fa0d6ac02 ]

    There's a number of drivers (e.g. dw_mmc, meson-gx, mmci, sunxi) using
    the same mechanism and a private flag vqmmc_enabled to deal with
    enabling/disabling the vqmmc regulator.

    Move this to the core and create new helpers mmc_regulator_enable_vqmmc
    and mmc_regulator_disable_vqmmc.

    Signed-off-by: Heiner Kallweit <[email protected]>
    Acked-by: Martin Blumenstingl <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Ulf Hansson <[email protected]>
    Stable-dep-of: 477865af60b2 ("mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled")
    Signed-off-by: Sasha Levin <[email protected]>

commit 0e0a95166882e594af4ab4f8c6f7894c2c32f6a9
Author: Dinghao Liu <[email protected]>
Date:   Thu Nov 23 15:33:22 2023 +0800

    drm/amd/pm: fix a memleak in aldebaran_tables_init

    [ Upstream commit 7a88f23e768491bae653b444a96091d2aaeb0818 ]

    When kzalloc() for smu_table->ecc_table fails, we should free
    the previously allocated resources to prevent memleak.

    Fixes: edd794208555 ("drm/amd/pm: add message smu to get ecc_table v2")
    Signed-off-by: Dinghao Liu <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 59862b869275c27beb25cda2054b59a8b5d04970
Author: Lu Baolu <[email protected]>
Date:   Wed Nov 22 11:26:05 2023 +0800

    iommu/vt-d: Make context clearing consistent with context mapping

    [ Upstream commit 9a16ab9d640274b20813d2d17475e18d3e99d834 ]

    In the iommu probe_device path, domain_context_mapping() allows setting
    up the context entry for a non-PCI device. However, in the iommu
    release_device path, domain_context_clear() only clears context entries
    for PCI devices.

    Make domain_context_clear() behave consistently with
    domain_context_mapping() by clearing context entries for both PCI and
    non-PCI devices.

    Fixes: 579305f75d34 ("iommu/vt-d: Update to use PCI DMA aliases")
    Signed-off-by: Lu Baolu <[email protected]>
    Reviewed-by: Kevin Tian <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Joerg Roedel <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit ee2c2247690c8bf27d4584fdebfd9b58d74495ee
Author: Lu Baolu <[email protected]>
Date:   Wed Nov 22 11:26:04 2023 +0800

    iommu/vt-d: Disable PCI ATS in legacy passthrough mode

    [ Upstream commit da37dddcf4caf015c400a930301d2ee27a7a15fb ]

    When IOMMU hardware operates in legacy mode, the TT field of the context
    entry determines the translation type, with three supported types (Section
    9.3 Context Entry):

    - DMA translation without device TLB support
    - DMA translation with device TLB support
    - Passthrough mode with translated and translation requests blocked

    Device TLB support is absent when hardware is configured in passthrough
    mode.

    Disable the PCI ATS feature when IOMMU is configured for passthrough
    translation type in legacy (non-scalable) mode.

    Fixes: 0faa19a1515f ("iommu/vt-d: Decouple PASID & PRI enabling from SVA")
    Signed-off-by: Lu Baolu <[email protected]>
    Reviewed-by: Kevin Tian <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Joerg Roedel <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 8f39d297a26ab4e1f2ad60adf3aa0434c500878a
Author: Lu Baolu <[email protected]>
Date:   Tue Nov 22 08:29:44 2022 +0800

    iommu/vt-d: Add device_block_translation() helper

    [ Upstream commit c7be17c2903d4acbf9aa372bfb6e2a418387fce0 ]

    If domain attaching to device fails, the IOMMU driver should bring the
    device to blocking DMA state. The upper layer is expected to recover it
    by attaching a new domain. Use device_block_translation() in the error
    path of dev_attach to make the behavior specific.

    The difference between device_block_translation() and the previous
    dmar_remove_one_dev_info() is that, in the scalable mode, it is the
    RID2PASID entry instead of context entry being cleared. As a result,
    enabling PCI capabilities is moved up.

    Signed-off-by: Lu Baolu <[email protected]>
    Reviewed-by: Kevin Tian <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Joerg Roedel <[email protected]>
    Stable-dep-of: da37dddcf4ca ("iommu/vt-d: Disable PCI ATS in legacy passthrough mode")
    Signed-off-by: Sasha Levin <[email protected]>

commit 3787b3168b6c5f74e5e411f72e19322186fa2e4b
Author: Lu Baolu <[email protected]>
Date:   Tue Nov 22 08:29:43 2022 +0800

    iommu/vt-d: Allocate pasid table in device probe path

    [ Upstream commit ec62b4424174f41bdcedd08d12d7bed80088453d ]

    Whether or not a domain is attached to the device, the pasid table should
    always be valid as long as it has been probed. This moves the pasid table
    allocation from the domain attaching device path to device probe path and
    frees it in the device release path.

    Signed-off-by: Lu Baolu <[email protected]>
    Reviewed-by: Kevin Tian <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Joerg Roedel <[email protected]>
    Stable-dep-of: da37dddcf4ca ("iommu/vt-d: Disable PCI ATS in legacy passthrough mode")
    Signed-off-by: Sasha Levin <[email protected]>

commit 681aeeda413d6a379710d750916c582d67dd6635
Author: Lu Baolu <[email protected]>
Date:   Wed Nov 22 11:26:03 2023 +0800

    iommu/vt-d: Omit devTLB invalidation requests when TES=0

    [ Upstream commit 0f5432a9b839847dcfe9fa369d72e3d646102ddf ]

    The latest VT-d spec indicates that when remapping hardware is disabled
    (TES=0 in Global Status Register), upstream ATS Invalidation Completion
    requests are treated as UR (Unsupported Request).

    Consequently, the spec recommends in section 4.3 Handling of Device-TLB
    Invalidations that software refrain from submitting any Device-TLB
    invalidation requests when address remapping hardware is disabled.

    Verify address remapping hardware is enabled prior to submitting Device-
    TLB invalidation requests.

    Fixes: 792fb43ce2c9 ("iommu/vt-d: Enable Intel IOMMU scalable mode by default")
    Signed-off-by: Lu Baolu <[email protected]>
    Reviewed-by: Kevin Tian <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Joerg Roedel <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 8aaed5b81d26dd80fe043837b71e17e521ad2733
Author: Christoph Niedermaier <[email protected]>
Date:   Wed Nov 22 14:41:13 2023 +0100

    cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily

    [ Upstream commit 2e4e0984c7d696cc74cf2fd7e7f62997f0e9ebe6 ]

    For a 900MHz i.MX6ULL CPU the 792MHz OPP is disabled. There is no
    convincing reason to disable this OPP. If a CPU can run at 900MHz,
    it should also be able to cope with 792MHz. Looking at the voltage
    level of 792MHz in [1] (page 24, table 10. "Operating Ranges") the
    current defined OPP is above the minimum. So the voltage level
    shouldn't be a problem. However in [2] (page 24, table 10.
    "Operating Ranges"), it is not mentioned that 792MHz OPP isn't
    allowed. Change it to only disable 792MHz OPP for i.MX6ULL types
    below 792 MHz.

    [1] https://www.nxp.com/docs/en/data-sheet/IMX6ULLIEC.pdf
    [2] https://www.nxp.com/docs/en/data-sheet/IMX6ULLCEC.pdf

    Fixes: 0aa9abd4c212 ("cpufreq: imx6q: check speed grades for i.MX6ULL")
    Signed-off-by: Christoph Niedermaier <[email protected]>
    Reviewed-by: Marek Vasut <[email protected]>
    Reviewed-by: Fabio Estevam <[email protected]>
    [ Viresh: Edited subject ]
    Signed-off-by: Viresh Kumar <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit d3788f6e9d5a9c9a869d6df386119197904a55f2
Author: Christoph Niedermaier <[email protected]>
Date:   Fri May 12 17:07:11 2023 +0200

    cpufreq: imx6q: don't warn for disabling a non-existing frequency

    [ Upstream commit 11a3b0ac33d95aa84be426e801f800997262a225 ]

    It is confusing if a warning is given for disabling a non-existent
    frequency of the operating performance points (OPP). In this case
    the function dev_pm_opp_disable() returns -ENODEV. Check the return
    value and avoid the output of a warning in this case. Avoid code
    duplication by using a separate function.

    Signed-off-by: Christoph Niedermaier <[email protected]>
    [ Viresh : Updated commit subject ]
    Signed-off-by: Viresh Kumar <[email protected]>
    Stable-dep-of: 2e4e0984c7d6 ("cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily")
    Signed-off-by: Sasha Levin <[email protected]>

commit 195514bda626b16fb6ef9ff4172dc0433a3c105b
Author: Nicholas Kazlauskas <[email protected]>
Date:   Wed Sep 13 16:18:44 2023 -0400

    drm/amd/display: Guard against invalid RPTR/WPTR being set

    [ Upstream commit 1ffa8602e39b89469dc703ebab7a7e44c33da0f7 ]

    [WHY]
    HW can return invalid values on register read, guard against these being
    set and causing us to access memory out of range and page fault.

    [HOW]
    Guard at sync_inbox1 and guard at pushing commands.

    Cc: Mario Limonciello <[email protected]>
    Cc: Alex Deucher <[email protected]>
    Cc: [email protected]
    Reviewed-by: Hansen Dsouza <[email protected]>
    Acked-by: Alex Hung <[email protected]>
    Signed-off-by: Nicholas Kazlauskas <[email protected]>
    Tested-by: Daniel Wheeler <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 395a63ca1ad2e0534176cac91f5715961e744529
Author: JinZe.Xu <[email protected]>
Date:   Mon Apr 10 23:23:37 2023 +0800

    drm/amd/display: Restore rptr/wptr for DMCUB as workaround

    [ Upstream commit 8f3589bb6fcea397775398cba4fbcc46829a60ed ]

    [Why]
    States may be desync after resume.

    [How]
    Sync sw state with hw state.

    Tested-by: Daniel Wheeler <[email protected]>
    Reviewed-by: Nicholas Kazlauskas <[email protected]>
    Acked-by: Rodrigo Siqueira <[email protected]>
    Signed-off-by: JinZe.Xu <[email protected]>
    Signed-off-by: Alex Deucher <[email protected]>
    Stable-dep-of: 1ffa8602e39b ("drm/amd/display: Guard against invalid RPTR/WPTR being set")
    Signed-off-by: Sasha Levin <[email protected]>

commit 4ec4508db97502a12daee88c74782e8d35ced068
Author: Mark Hasemeyer <[email protected]>
Date:   Tue Nov 7 14:47:43 2023 -0700

    spi: Fix null dereference on suspend

    [ Upstream commit bef4a48f4ef798c4feddf045d49e53c8a97d5e37 ]

    A race condition exists where a synchronous (noqueue) transfer can be
    active during a system suspend. This can cause a null pointer
    dereference exception to occur when the system resumes.

    Example order of events leading to the exception:
    1. spi_sync() calls __spi_transfer_message_noqueue() which sets
       ctlr->cur_msg
    2. Spi transfer begins via spi_transfer_one_message()
    3. System is suspended interrupting the transfer context
    4. System is resumed
    6. spi_controller_resume() calls spi_start_queue() which resets cur_msg
       to NULL
    7. Spi transfer context resumes and spi_finalize_current_message() is
       called which dereferences cur_msg (which is now NULL)

    Wait for synchronous transfers to complete before suspending by
    acquiring the bus mutex and setting/checking a suspend flag.

    Signed-off-by: Mark Hasemeyer <[email protected]>
    Link: https://lore.kernel.org/r/20231107144743.v1.1.I7987f05f61901f567f7661763646cb7d7919b528@changeid
    Signed-off-by: Mark Brown <[email protected]>
    Cc: [email protected]
    Signed-off-by: Sasha Levin <[email protected]>

commit b57eebfb80e81f8cc01cd038ceaabca860a22236
Author: Helge Deller <[email protected]>
Date:   Fri Oct 27 13:36:48 2023 +0200

    fbdev: stifb: Make the STI next font pointer a 32-bit signed offset

    [ Upstream commit 8a32aa17c1cd48df1ddaa78e45abcb8c7a2220d6 ]

    The pointer to the next STI font is actually a signed 32-bit
    offset. With this change the 64-bit kernel will correctly subract
    the (signed 32-bit) offset instead of adding a (unsigned 32-bit)
    offset. It has no effect on 32-bit kernels.

    This fixes the stifb driver with a 64-bit kernel on qemu.

    Signed-off-by: Helge Deller <[email protected]>
    Cc: [email protected]
    Signed-off-by: Sasha Levin <[email protected]>

commit 5bc8d96fedcea51313021d779ff977d4f2172902
Author: Manivannan Sadhasivam <[email protected]>
Date:   Wed Oct 25 18:30:29 2023 +0530

    PCI: qcom-ep: Add dedicated callback for writing to DBI2 registers

    [ Upstream commit a07d2497ed657eb2efeb967af47e22f573dcd1d6 ]

    The DWC core driver exposes the write_dbi2() callback for writing to the
    DBI2 registers in a vendor-specific way.

    On the Qcom EP platforms, the DBI_CS2 bit in the ELBI region needs to be
    asserted before writing to any DBI2 registers and deasserted once done.

    So, let's implement the callback for the Qcom PCIe EP driver so that the
    DBI2 writes are correctly handled in the hardware.

    Without this callback, the DBI2 register writes like BAR size won't go
    through and as a result, the default BAR size is set for all BARs.

    [kwilczynski: commit log, renamed function to match the DWC convention]
    Fixes: f55fee56a631 ("PCI: qcom-ep: Add Qualcomm PCIe Endpoint controller driver")
    Suggested-by: Serge Semin <[email protected]>
    Link: https://lore.kernel.org/linux-pci/[email protected]
    Signed-off-by: Manivannan Sadhasivam <[email protected]>
    Signed-off-by: Krzysztof Wilczyński <[email protected]>
    Reviewed-by: Serge Semin <[email protected]>
    Cc: [email protected] # 5.16+
    Signed-off-by: Sasha Levin <[email protected]>

commit 10c3d86fea040d4123e569d83a8431a71e36d3d7
Author: Suman Ghosh <[email protected]>
Date:   Thu Jul 27 22:01:01 2023 +0530

    octeontx2-af: Initialize 'cntr_val' to fix uninitialized symbol error

    commit 222a6c42e9ef131fd20463bf95d7ce7b39bee2f8 upstream.

    drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c:860
    otx2_tc_update_mcam_table_del_req()
    error: uninitialized symbol 'cntr_val'.

    Fixes: ec87f05402f5 ("octeontx2-af: Install TC filter rules in hardware based on priority")
    Signed-off-by: Suman Ghosh <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Greg Kroah-Hartman <[email protected]>

commit 1c8f75ee92334d89f1ddada26d47f9caa955f1a4
Author: Lukas Wunner <[email protected]>
Date:   Thu Sep 21 16:23:34 2023 +0200

    PCI: Lengthen reset delay for VideoPropulsion Torrent QN16e card

    [ Upstream commit c9260693aa0c1e029ed23693cfd4d7814eee6624 ]

    Commit ac91e6980563 ("PCI: Unify delay handling for reset and resume")
    shortened an unconditional 1 sec delay after a Secondary Bus Reset to 100
    msec for PCIe (per PCIe r6.1 sec 6.6.1).  The 1 sec delay is only required
    for Conventional PCI.

    But it turns out that there are PCIe devices which require a longer delay
    than prescribed before first config space access after reset recovery or
    resume from D3cold:

    Chad reports that a "VideoPropulsion Torrent QN16e" MPEG QAM Modulator
    "raises a PCI system error (PERR), as reported by the IPMI event log, and
    the hardware itself would suffer a catastrophic event, cycling the server"
    unless the longer delay is observed.

    The card is specified to conform to PCIe r1.0 and indeed only supports Gen1
    speed (2.5 GT/s) according to lspci.  PCIe r1.0 sec 7.6 prescribes the same
    100 msec delay as PCIe r6.1 sec 6.6.1:

      To allow components to perform internal initialization, system software
      must wait for at least 100 ms from the end of a reset (cold/warm/hot)
      before it is permitted to issue Configuration Requests

    The behavior of the Torrent QN16e card thus appears to be a quirk.  Treat
    it as such and lengthen the reset delay for this specific device.

    Fixes: ac91e6980563 ("PCI: Unify delay handling for reset and resume")
    Link: https://lore.kernel.org/r/47727e792c7f0282dc144e3ec8ce8eb6e713394e.1695304512.git.lukas@wunner.de
    Reported-by: Chad Schroeder <[email protected]>
    Closes: https://lore.kernel.org/linux-pci/DM6PR16MB2844903E34CAB910082DF019B1FAA@DM6PR16MB2844.namprd16.prod.outlook.com/
    Tested-by: Chad Schroeder <[email protected]>
    Signed-off-by: Lukas Wunner <[email protected]>
    Signed-off-by: Bjorn Helgaas <[email protected]>
    Cc: [email protected] # v5.4+
    Signed-off-by: Sasha Levin <[email protected]>

commit 7545ddda9c98545c9c797bef89f26df44f89fb13
Author: Haitao Shan <[email protected]>
Date:   Tue Sep 12 16:55:45 2023 -0700

    KVM: x86: Fix lapic timer interrupt lost after loading a snapshot.

    [ Upstream commit 9cfec6d097c607e36199cf0cfbb8cf5acbd8e9b2 ]

    When running android emulator (which is based on QEMU 2.12) on
    certain Intel hosts with kernel version 6.3-rc1 or above, guest
    will freeze after loading a snapshot. This is almost 100%
    reproducible. By default, the android emulator will use snapshot
    to speed up the next launching of the same android guest. So
    this breaks the android emulator badly.

    I tested QEMU 8.0.4 from Debian 12 with an Ubuntu 22.04 guest by
    running command "loadvm" after "savevm". The same issue is
    observed. At the same time, none of our AMD platforms is impacted.
    More experiments show that loading the KVM module with
    "enable_apicv=false" can workaround it.

    The issue started to show up after commit 8e6ed96cdd50 ("KVM: x86:
    fire timer when it is migrated and expired, and in oneshot mode").
    However, as is pointed out by Sean Christopherson, it is introduced
    by commit 967235d32032 ("KVM: vmx: clear pending interrupts on
    KVM_SET_LAPIC"). commit 8e6ed96cdd50 ("KVM: x86: fire timer when
    it is migrated and expired, and in oneshot mode") just makes it
    easier to hit the issue.

    Having both commits, the oneshot lapic timer gets fired immediately
    inside the KVM_SET_LAPIC call when loading the snapshot. On Intel
    platforms with APIC virtualization and posted interrupt processing,
    this eventually leads to setting the corresponding PIR bit. However,
    the whole PIR bits get cleared later in the same KVM_SET_LAPIC call
    by apicv_post_state_restore. This leads to timer interrupt lost.

    The fix is to move vmx_apicv_post_state_restore to the beginning of
    the KVM_SET_LAPIC call and rename to vmx_apicv_pre_state_restore.
    What vmx_apicv_post_state_restore does is actually clearing any
    former apicv state and this behavior is more suitable to carry out
    in the beginning.

    Fixes: 967235d32032 ("KVM: vmx: clear pending interrupts on KVM_SET_LAPIC")
    Cc: [email protected]
    Suggested-by: Sean Christopherson <[email protected]>
    Signed-off-by: Haitao Shan <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Sean Christopherson <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 21feaf558f93740404f9a6c195e99eb479d330c3
Author: Claudiu Beznea <[email protected]>
Date:   Tue Nov 28 10:04:39 2023 +0200

    net: ravb: Keep reverse order of operations in ravb_remove()

    [ Upstream commit edf9bc396e05081ca281ffb0cd41e44db478ff26 ]

    On RZ/G3S SMARC Carrier II board having RGMII connections b/w Ethernet
    MACs and PHYs it has been discovered that doing unbind/bind for ravb
    driver in a loop leads to wrong speed and duplex for Ethernet links and
    broken connectivity (the connectivity cannot be restored even with
    bringing interface down/up). Before doing unbind/bind the Ethernet
    interfaces were configured though systemd. The sh instructions used to
    do unbind/bind were:

    $ cd /sys/bus/platform/drivers/ravb/
    $ while :; do echo 11c30000.ethernet > unbind ; \
      echo 11c30000.ethernet > bind; done

    It has been discovered that there is a race b/w IOCTLs initialized by
    systemd at the response of success binding and the
    "ravb_write(ndev, CCC_OPC_RESET, CCC)" call in ravb_remove() as
    follows:

    1/ as a result of bind success the user space open/configures the
       interfaces tough an IOCTL; the following stack trace has been
       identified on RZ/G3S:

    Call trace:
    dump_backtrace+0x9c/0x100
    show_stack+0x20/0x38
    dump_stack_lvl+0x48/0x60
    dump_stack+0x18/0x28
    ravb_open+0x70/0xa58
    __dev_open+0xf4/0x1e8
    __dev_change_flags+0x198/0x218
    dev_change_flags+0x2c/0x80
    devinet_ioctl+0x640/0x708
    inet_ioctl+0x1e4/0x200
    sock_do_ioctl+0x50/0x108
    sock_ioctl+0x240/0x358
    __arm64_sys_ioctl+0xb0/0x100
    invoke_syscall+0x50/0x128
    el0_svc_common.constprop.0+0xc8/0xf0
    do_el0_svc+0x24/0x38
    el0_svc+0x34/0xb8
    el0t_64_sync_handler+0xc0/0xc8
    el0t_64_sync+0x190/0x198

    2/ this call may execute concurrently with ravb_remove() as the
       unbind/bind operation was executed in a loop
    3/ if the operation mode is changed to RESET (through
       ravb_write(ndev, CCC_OPC_RESET, CCC) call in ravb_remove())
       while the above ravb_open() is in progress it may lead to MAC
       (or PHY, or MAC-PHY connection, the right point hasn't been identified
       at the moment) to be broken, thus the Ethernet connectivity fails to
       restore.

    The simple fix for this is to move ravb_write(ndev, CCC_OPC_RESET, CCC))
    after unregister_netdev() to avoid resetting the controller while the
    netdev interface is still registered.

    To avoid future issues in ravb_remove(), the patch follows the proper order
    of operations in ravb_remove(): reverse order compared with ravb_probe().
    This avoids described races as the IOCTLs as well as unregister_netdev()
    (called now at the beginning of ravb_remove()) calls rtnl_lock() before
    continuing and IOCTLs check (though devinet_ioctl()) if device is still
    registered just after taking the lock:

    int devinet_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr)
    {
    	// ...

            rtnl_lock();

            ret = -ENODEV;
            dev = __dev_get_by_name(net, ifr->ifr_name);
            if (!dev)
                    goto done;

    	// ...
    done:
            rtnl_unlock();
    out:
            return ret;
    }

    Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
    Reviewed-by: Sergey Shtylyov <[email protected]>
    Signed-off-by: Claudiu Beznea <[email protected]>
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 8d04278ff48b202650077cb11ee6923e7a24aaa7
Author: Claudiu Beznea <[email protected]>
Date:   Tue Nov 28 10:04:38 2023 +0200

    net: ravb: Stop DMA in case of failures on ravb_open()

    [ Upstream commit eac16a733427ba0de2449ffc7bd3da32ddb65cb7 ]

    In case ravb_phy_start() returns with error the settings applied in
    ravb_dmac_init() are not reverted (e.g. config mode). For this call
    ravb_stop_dma() on failure path of ravb_open().

    Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver")
    Reviewed-by: Sergey Shtylyov <[email protected]>
    Signed-off-by: Claudiu Beznea <[email protected]>
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 52b751686cbf2e468319bb78e4cb026e715a17eb
Author: Claudiu Beznea <[email protected]>
Date:   Tue Nov 28 10:04:37 2023 +0200

    net: ravb: Start TX queues after HW initialization succeeded

    [ Upstream commit 6f32c086602050fc11157adeafaa1c1eb393f0af ]

    ravb_phy_start() may fail. If that happens, the TX queues will remain
    started. Thus, move the netif_tx_start_all_queues() after PHY is
    successfully initialized.

    Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
    Reviewed-by: Sergey Shtylyov <[email protected]>
    Signed-off-by: Claudiu Beznea <[email protected]>
    Reviewed-by: Kalesh AP <[email protected]>
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit e2db25d16cdd39292371c73847942ade7b8c4a2e
Author: Claudiu Beznea <[email protected]>
Date:   Tue Nov 28 10:04:36 2023 +0200

    net: ravb: Make write access to CXR35 first before accessing other EMAC registers

    [ Upstream commit d78c0ced60d5e2f8b5a4a0468a5c400b24aeadf2 ]

    Hardware manual of RZ/G3S (and RZ/G2L) specifies the following on the
    description of CXR35 register (chapter "PHY interface select register
    (CXR35)"): "After release reset, make write-access to this register before
    making write-access to other registers (except MDIOMOD). Even if not need
    to change the value of this register, make write-access to this register
    at least one time. Because RGMII/MII MODE is recognized by accessing this
    register".

    The setup procedure for EMAC module (chapter "Setup procedure" of RZ/G3S,
    RZ/G2L manuals) specifies the E-MAC.CXR35 register is the first EMAC
    register that is to be configured.

    Note [A] from chapter "PHY interface select register (CXR35)" specifies
    the following:
    [A] The case which CXR35 SEL_XMII is used for the selection of RGMII/MII
    in APB Clock 100 MHz.
    (1) To use RGMII interface, Set ‘H’03E8_0000’ to this register.
    (2) To use MII interface, Set ‘H’03E8_0002’ to this register.

    Take into account these indication.

    Fixes: 1089877ada8d ("ravb: Add RZ/G2L MII interface support")
    Reviewed-by: Sergey Shtylyov <[email protected]>
    Signed-off-by: Claudiu Beznea <[email protected]>
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit f5c649ce7975ed5b0b9348e218a7e6b7840d8932
Author: Claudiu Beznea <[email protected]>
Date:   Tue Nov 28 10:04:35 2023 +0200

    net: ravb: Use pm_runtime_resume_and_get()

    [ Upstream commit 88b74831faaee455c2af380382d979fc38e79270 ]

    pm_runtime_get_sync() may return an error. In case it returns with an error
    dev->power.usage_count needs to be decremented. pm_runtime_resume_and_get()
    takes care of this. Thus use it.

    Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
    Reviewed-by: Sergey Shtylyov <[email protected]>
    Signed-off-by: Claudiu Beznea <[email protected]>
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 149b2fe12acac482e43d93016a42515cc7834cde
Author: Claudiu Beznea <[email protected]>
Date:   Tue Nov 28 10:04:34 2023 +0200

    net: ravb: Check return value of reset_control_deassert()

    [ Upstream commit d8eb6ea4b302e7ff78535c205510e359ac10a0bd ]

    reset_control_deassert() could return an error. Some devices cannot work
    if reset signal de-assert operation fails. To avoid this check the return
    code of reset_control_deassert() in ravb_probe() and take proper action.

    Along with it, the free_netdev() call from the error path was moved after
    reset_control_assert() on its own label (out_free_netdev) to free
    netdev in case reset_control_deassert() fails.

    Fixes: 0d13a1a464a0 ("ravb: Add reset support")
    Reviewed-by: Sergey Shtylyov <[email protected]>
    Reviewed-by: Philipp Zabel <[email protected]>
    Signed-off-by: Claudiu Beznea <[email protected]>
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 7ed2e4c2d016fdb0efda0fa8bf5ac6db21c88d89
Author: Yoshihiro Shimoda <[email protected]>
Date:   Mon Nov 27 21:24:20 2023 +0900

    ravb: Fix races between ravb_tx_timeout_work() and net related ops

    [ Upstream commit 9870257a0a338cd8d6c1cddab74e703f490f6779 ]

    Fix races between ravb_tx_timeout_work() and functions of net_device_ops
    and ethtool_ops by using rtnl_trylock() and rtnl_unlock(). Note that
    since ravb_close() is under the rtnl lock and calls cancel_work_sync(),
    ravb_tx_timeout_work() should calls rtnl_trylock(). Otherwise, a deadlock
    may happen in ravb_tx_timeout_work() like below:

    CPU0			CPU1
    			ravb_tx_timeout()
    			schedule_work()
    ...
    __dev_close_many()
    // Under rtnl lock
    ravb_close()
    cancel_work_sync()
    // Waiting
    			ravb_tx_timeout_work()
    			rtnl_lock()
    			// This is possible to cause a deadlock

    If rtnl_trylock() fails, rescheduling the work with sleep for 1 msec.

    Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
    Signed-off-by: Yoshihiro Shimoda <[email protected]>
    Reviewed-by: Sergey Shtylyov <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 8b1d088be5f108e3ebf7541a6639fef03df3d9b1
Author: Heiner Kallweit <[email protected]>
Date:   Sun Nov 26 23:01:02 2023 +0100

    r8169: prevent potential deadlock in rtl8169_close

    [ Upstream commit 91d3d149978ba7b238198dd80e4b823756aa7cfa ]

    ndo_stop() is RTNL-protected by net core, and the worker function takes
    RTNL as well. Therefore we will deadlock when trying to execute a
    pending work synchronously. To fix this execute any pending work
    asynchronously. This will do no harm because netif_running() is false
    in ndo_stop(), and therefore the work function is effectively a no-op.
    However we have to ensure that no task is running or pending after
    rtl_remove_one(), therefore add a call to cancel_work_sync().

    Fixes: abe5fc42f9ce ("r8169: use RTNL to protect critical sections")
    Signed-off-by: Heiner Kallweit <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 9c4ac2d98a48097500e09acad5efa347a86a1fa5
Author: Subbaraya Sundeep <[email protected]>
Date:   Sat Nov 25 22:06:57 2023 +0530

    octeontx2-pf: Restore TC ingress police rules when interface is up

    [ Upstream commit fd7f98b2e12a3d96a92bde6640657ec7116f4372 ]

    TC ingress policer rules depends on interface receive queue
    contexts since the bandwidth profiles are attached to RQ
    contexts. When an interface is brought down all the queue
    contexts are freed. This in turn frees bandwidth profiles in
    hardware causing ingress police rules non-functional after
    the interface is brought up. Fix this by applying all the ingress
    police rules config to hardware in otx2_open. Also allow
    adding ingress rules only when interface is running
    since no contexts exist for the interface when it is down.

    Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower")
    Signed-off-by: Subbaraya Sundeep <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit aef2d5b3e56e1491d4f15e7a707d3bcb0ebe2411
Author: Suman Ghosh <[email protected]>
Date:   Fri Jul 21 10:09:25 2023 +0530

    octeontx2-af: Install TC filter rules in hardware based on priority

    [ Upstream commit ec87f05402f592d27507e1aa6b2fd21c486f2cc0 ]

    As of today, hardware does not support installing tc filter
    rules based on priority. This patch adds support to install
    the hardware rules based on priority. The final hardware rules
    will not be dependent on rule installation order, it will be strictly
    priority based, same as software.

    Signed-off-by: Suman Ghosh <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Stable-dep-of: fd7f98b2e12a ("octeontx2-pf: Restore TC ingress police rules when interface is up")
    Signed-off-by: Sasha Levin <[email protected]>

commit 662b88708408952dc61ff43f3931d2d223799cb2
Author: Geetha sowjanya <[email protected]>
Date:   Sat Nov 25 22:04:02 2023 +0530

    octeontx2-pf: Fix adding mbox work queue entry when num_vfs > 64

    [ Upstream commit 51597219e0cd5157401d4d0ccb5daa4d9961676f ]

    When more than 64 VFs are enabled for a PF then mbox communication
    between VF and PF is not working as mbox work queueing for few VFs
    are skipped due to wrong calculation of VF numbers.

    Fixes: d424b6c02415 ("octeontx2-pf: Enable SRIOV and added VF mbox handling")
    Signed-off-by: Geetha sowjanya <[email protected]>
    Signed-off-by: Subbaraya Sundeep <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 5d5bcfb1ca8d2670d944f1e2899ba654f5d92eaf
Author: Furong Xu <[email protected]>
Date:   Sat Nov 25 14:01:26 2023 +0800

    net: stmmac: xgmac: Disable FPE MMC interrupts

    [ Upstream commit e54d628a2721bfbb002c19f6e8ca6746cec7640f ]

    Commit aeb18dd07692 ("net: stmmac: xgmac: Disable MMC interrupts
    by default") tries to disable MMC interrupts to avoid a storm of
    unhandled interrupts, but leaves the FPE(Frame Preemption) MMC
    interrupts enabled, FPE MMC interrupts can cause the same problem.
    Now we mask FPE TX and RX interrupts to disable all MMC interrupts.

    Fixes: aeb18dd07692 ("net: stmmac: xgmac: Disable MMC interrupts by default")
    Reviewed-by: Larysa Zaremba <[email protected]>
    Signed-off-by: Furong Xu <[email protected]>
    Reviewed-by: Serge Semin <[email protected]>
    Reviewed-by: Wojciech Drewek <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 334e6378c28c2dd0584259777a76b413aaa25fb1
Author: Elena Salomatkina <[email protected]>
Date:   Sat Nov 25 00:08:02 2023 +0300

    octeontx2-af: Fix possible buffer overflow

    [ Upstream commit ad31c629ca3c87f6d557488c1f9faaebfbcd203c ]

    A loop in rvu_mbox_handler_nix_bandprof_free() contains
    a break if (idx == MAX_BANDPROF_PER_PFFUNC),
    but if idx may reach MAX_BANDPROF_PER_PFFUNC
    buffer '(*req->prof_idx)[layer]' overflow happens before that check.

    The patch moves the break to the
    beginning of the loop.

    Found by Linux Verification Center (linuxtesting.org) with SVACE.

    Fixes: e8e095b3b370 ("octeontx2-af: cn10k: Bandwidth profiles config support").
    Signed-off-by: Elena Salomatkina <[email protected]>
    Reviewed-by: Simon Horman <[email protected]>
    Reviewed-by: Subbaraya Sundeep <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Paolo Abeni <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit c3e974e9c4bba86f8126724981616a4b077aa797
Author: Willem de Bruijn <[email protected]>
Date:   Fri Nov 24 12:15:22 2023 -0500

    selftests/net: mptcp: fix uninitialized variable warnings

    [ Upstream commit 00a4f8fd9c750f20d8fd4535c71c9caa7ef5ff2f ]

    Same init_rng() in both tests. The function reads /dev/urandom to
    initialize srand(). In case of failure, it falls back onto the
    entropy in the uninitialized variable. Not sure if this is on purpose.
    But failure reading urandom should be rare, so just fail hard. While
    at it, convert to getrandom(). Which man 4 random suggests is simpler
    and more robust.

        mptcp_inq.c:525:6:
        mptcp_connect.c:1131:6:

        error: variable 'foo' is used uninitialized
        whenever 'if' condition is false
        [-Werror,-Wsometimes-uninitialized]

    Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
    Fixes: b51880568f20 ("selftests: mptcp: add inq test case")
    Cc: Florian Westphal <[email protected]>
    Signed-off-by: Willem de Bruijn <[email protected]>

    ----

    When input is randomized because this is expected to meaningfully
    explore edge cases, should we also add
    1. logging the random seed to stdout and
    2. adding a command line argument to replay from a specific seed
    I can do this in net-next, if authors find it useful in this case.
    Reviewed-by: Matthieu Baerts <[email protected]>

    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 12dd4c1bf3bdd1bfdc5fe2b0f78dcbc28bd4d0d6
Author: Willem de Bruijn <[email protected]>
Date:   Fri Nov 24 12:15:21 2023 -0500

    selftests/net: unix: fix unused variable compiler warning

    [ Upstream commit 59fef379d453781f0dabfa1f1a1e86e78aee919a ]

    Remove an unused variable.

        diag_uid.c:151:24:
        error: unused variable 'udr'
        [-Werror,-Wunused-variable]

    Fixes: ac011361bd4f ("af_unix: Add test for sock_diag and UDIAG_SHOW_UID.")
    Signed-off-by: Willem de Bruijn <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 4e999af7cf8afa14c5ec548d11d2aced0f32d211
Author: Willem de Bruijn <[email protected]>
Date:   Fri Nov 24 12:15:20 2023 -0500

    selftests/net: fix a char signedness issue

    [ Upstream commit 7b29828c5af6841bdeb9fafa32fdfeff7ab9c407 ]

    Signedness of char is signed on x86_64, but unsigned on arm64.

    Fix the warning building cmsg_sender.c on signed platforms or
    forced with -fsigned-char:

        msg_sender.c:455:12:
        error: implicit conversion from 'int' to 'char'
        changes value from 128 to -128
        [-Werror,-Wconstant-conversion]
            buf[0] = ICMPV6_ECHO_REQUEST;

    constant ICMPV6_ECHO_REQUEST is 128.

    Link: https://lwn.net/Articles/911914
    Fixes: de17e305a810 ("selftests: net: cmsg_sender: support icmp and raw sockets")
    Signed-off-by: Willem de Bruijn <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 249ceee95caf3b86b995fb2d7a5b072a6fe1708a
Author: Willem de Bruijn <[email protected]>
Date:   Fri Nov 24 12:15:19 2023 -0500

    selftests/net: ipsec: fix constant out of range

    [ Upstream commit 088559815477c6f623a5db5993491ddd7facbec7 ]

    Fix a small compiler warning.

    nr_process must be a signed long: it is assigned a signed long by
    strtol() and is compared against LONG_MIN and LONG_MAX.

    ipsec.c:2280:65:
        error: result of comparison of constant -9223372036854775808
        with expression of type 'unsigned int' is always false
        [-Werror,-Wtautological-constant-out-of-range-compare]

      if ((errno == ERANGE && (nr_process == LONG_MAX || nr_process == LONG_MIN))

    Fixes: bc2652b7ae1e ("selftest/net/xfrm: Add test for ipsec tunnel")
    Signed-off-by: Willem de Bruijn <[email protected]>
    Reviewed-by: Dmitry Safonov <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Jakub Kicinski <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit e01249a8393903c5cdcc66355d83207296689fad
Author: Dmitry Antipov <[email protected]>
Date:   Mon Nov 20 14:05:08 2023 +0300

    uapi: propagate __struct_group() attributes to the container union

    [ Upstream commit 4e86f32a13af1970d21be94f659cae56bbe487ee ]

    Recently the kernel test robot has reported an ARM-specific BUILD_BUG_ON()
    in an old and unmaintained wil6210 wireless driver. The problem comes from
    the structure packing rules of old ARM ABI ('-mabi=apcs-gnu'). For example,
    the following structure is packed to 18 bytes instead of 16:

    struct poorly_packed {
            unsigned int a;
            unsigned int b;
            unsigned short c;
            union {
                    struct {
                            unsigned short d;
                            unsigned int e;
                    } __attribute__((packed));
                    struct {
                            unsigned short d;
                            unsigned int e;
                    } __attribute__((packed)) inner;
            };
    } __attribute__((packed));

    To fit it into 16 bytes, it's required to add packed attribute to the
    container union as well:

    struct poorly_packed {
            unsigned int a;
            unsigned int b;
            unsigned short c;
            union {
                    struct {
                            unsigned short d;
                            unsigned int e;
                    } __attribute__((packed));
                    struct {
                            unsigned short d;
                            unsigned int e;
                    } __attribute__((packed)) inner;
            } __attribute__((packed));
    } __attribute__((packed));

    Thanks to Andrew Pinski of GCC team for sorting the things out at
    https://gcc.gnu.org/pipermail/gcc/2023-November/242888.html.

    Reported-by: kernel test robot <[email protected]>
    Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]
    Signed-off-by: Dmitry Antipov <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Fixes: 50d7bd38c3aa ("stddef: Introduce struct_group() helper macro")
    Signed-off-by: Kees Cook <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit fd91b48f108d5c226b4775b2821ba4113c02374c
Author: Ioana Ciornei <[email protected]>
Date:   Fri Nov 24 12:28:04 2023 +0200

    dpaa2-eth: increase the needed headroom to account for alignment

    [ Upstream commit f422abe3f23d483cf01f386819f26fb3fe0dbb2b ]

    Increase the needed headroom to account for a 64 byte alignment
    restriction which, with this patch, we make mandatory on the Tx path.
    The case in which the amount of headroom needed is not available is
    already handled by the driver which instead sends a S/G frame with the
    first buffer only holding the SW and HW annotation areas.

    Without this patch, we can empirically see data corruption happening
    between Tx and Tx confirmation which sometimes leads to the SW
    annotation area being overwritten.

    Since this is an old IP where the hardware team cannot help to
    understand the underlying behavior, we make the Tx alignment mandatory
    for all frames to avoid the crash on Tx conf. Also, remove the comment
    that suggested that this is just an optimization.

    This patch also sets the needed_headroom net device field to the usual
    value that the driver would need on the Tx path:
    	- 64 bytes for the software annotation area
    	- 64 bytes to account for a 64 byte aligned buffer address

    Fixes: 6e2387e8f19e ("staging: fsl-dpaa2/eth: Add Freescale DPAA2 Ethernet driver")
    Closes: https://lore.kernel.org/netdev/[email protected]/
    Signed-off-by: Ioana Ciornei <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 94445d9583079e0ccc5dde1370076ff24800d86e
Author: Zhengchao Shao <[email protected]>
Date:   Thu Nov 23 15:13:14 2023 +0800

    ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet

    [ Upstream commit e2b706c691905fe78468c361aaabc719d0a496f1 ]

    When I perform the following test operations:
    1.ip link add br0 type bridge
    2.brctl addif br0 eth0
    3.ip addr add 239.0.0.1/32 dev eth0
    4.ip addr add 239.0.0.1/32 dev br0
    5.ip addr add 224.0.0.1/32 dev br0
    6.while ((1))
        do
            ifconfig br0 up
            ifconfig br0 down
        done
    7.send IGMPv2 query packets to port eth0 continuously. For example,
    ./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
    1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

    The preceding tests may trigger the refcnt uaf issue of the mc list. The
    stack is as follows:
    	refcount_t: addition on 0; use-after-free.
    	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
    	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80
    	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
    	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
    	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
    	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
    	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
    	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
    	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
    	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
    	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
    	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
    	Call Trace:
    	<TASK>
    	igmp_heard_query (net/ipv4/igmp.c:1068)
    	igmp_rcv (net/ipv4/igmp.c:1132)
    	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
    	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
    	__netif_receive_skb_one_core (net/core/dev.c:5529)
    	netif_receive_skb_internal (net/core/dev.c:5729)
    	netif_receive_skb (net/core/dev.c:5788)
    	br_handle_frame_finish (net/bridge/br_input.c:216)
    	nf_hook_bridge_pre (net/bridge/br_input.c:294)
    	__netif_receive_skb_core (net/core/dev.c:5423)
    	__netif_receive_skb_list_core (net/core/dev.c:5606)
    	__netif_receive_skb_list (net/core/dev.c:5674)
    	netif_receive_skb_list_internal (net/core/dev.c:5764)
    	napi_gro_receive (net/core/gro.c:609)
    	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
    	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
    	__napi_poll (net/core/dev.c:6533)
    	net_rx_action (net/core/dev.c:6735)
    	__do_softirq (kernel/softirq.c:554)
    	run_ksoftirqd (kernel/softirq.c:913)
    	smpboot_thread_fn (kernel/smpboot.c:164)
    	kthread (kernel/kthread.c:388)
    	ret_from_fork (arch/x86/kernel/process.c:153)
    	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
    	</TASK>

    The root causes are as follows:
    Thread A					Thread B
    ...						netif_receive_skb
    br_dev_stop					...
        br_multicast_leave_snoopers			...
            __ip_mc_dec_group			...
                __igmp_group_dropped		igmp_rcv
                    igmp_stop_timer			    igmp_heard_query         //ref = 1
                    ip_ma_put			        igmp_mod_timer
                        refcount_dec_and_test	            igmp_start_timer //ref = 0
    			...                                     refcount_inc //ref increases from 0
    When the device receives an IGMPv2 Query message, it starts the timer
    immediately, regardless of whether the device is running. If the device is
    down and has left the multicast group, it will cause the mc list refcount
    uaf issue.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Zhengchao Shao <[email protected]>
    Reviewed-by: Eric Dumazet <[email protected]>
    Reviewed-by: Hangbin Liu <[email protected]>
    Signed-off-by: David S. Miller <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit f89fef7710b2ba0f7a1e46594e530dcf2f77be91
Author: Niklas Neronin <[email protected]>
Date:   Wed Nov 15 14:13:25 2023 +0200

    usb: config: fix iteration issue in 'usb_get_bos_descriptor()'

    [ Upstream commit 974bba5c118f4c2baf00de0356e3e4f7928b4cbc ]

    The BOS descriptor defines a root descriptor and is the base descriptor for
    accessing a family of related descriptors.

    Function 'usb_get_bos_descriptor()' encounters an iteration issue when
    skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in
    the same descriptor being read repeatedly.

    To address this issue, a 'goto' statement is introduced to ensure that the
    pointer and the amount read is updated correctly. This ensures that the
    function iterates to the next descriptor instead of reading the same
    descriptor repeatedly.

    Cc: [email protected]
    Fixes: 3dd550a2d365 ("USB: usbcore: Fix slab-out-of-bounds bug during device reset")
    Signed-off-by: Niklas Neronin <[email protected]>
    Acked-by: Mathias Nyman <[email protected]>
    Reviewed-by: Alan Stern <[email protected]>
    Link: https://lore.kernel.org/r/[email protected]
    Signed-off-by: Greg Kroah-Hartman <[email protected]>
    Signed-off-by: Sasha Levin <[email protected]>

commit 9aff7c51b440cc5dab4d527c2fd5412631f99644
…
logic10492 pushed a commit to logic10492/linux-amd-zen2 that referenced this pull request Jan 18, 2024
@htejun
Merge pull request torvalds#80 from sched-ext/scx-cleanups-from-split
607afb6 
Scx cleanups from split
gyroninja added a commit to gyroninja/linux that referenced this pull request Jan 28, 2024
@gyroninja
[WIP] Fix infinite recursion during KMSAN initialization
498e53b 
KSAN calls into rcu code which then triggers a write that reenters into KSAN
getting the system stuck doing infinite recursion.

#0  kmsan_get_context () at mm/kmsan/kmsan.h:106
#1  __msan_get_context_state () at mm/kmsan/instrumentation.c:331
#2  0xffffffff81495671 in get_current () at ./arch/x86/include/asm/current.h:42
#3  rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
#4  __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
#5  0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#6  pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#7  kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#8  virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#9  0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#10 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#11 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#12 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#13 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#14 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#15 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#16 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#17 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#18 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#19 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#20 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#21 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#22 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#23 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#24 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#25 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#26 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#27 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#28 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#29 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#30 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#31 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#32 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#33 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#34 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#35 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#36 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#37 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#38 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#39 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#40 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#41 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#42 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#43 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#44 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#45 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#46 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#47 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#48 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#49 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#50 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#51 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
#52 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
#53 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#54 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#55 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#56 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#57 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
#58 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#59 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#60 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#61 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#62 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#63 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#64 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#65 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#66 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#67 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#68 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#69 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
#70 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#71 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#72 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#73 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#74 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#75 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#76 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#77 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff86203c90) at ./arch/x86/include/asm/kmsan.h:82
torvalds#78 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff86203c90) at mm/kmsan/shadow.c:75
torvalds#79 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff86203c90, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#80 kmsan_get_shadow_origin_ptr (address=0xffffffff86203c90, size=8, store=false) at mm/kmsan/shadow.c:97
torvalds#81 0xffffffff81b1dc72 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=8, store=false) at mm/kmsan/instrumentation.c:36
torvalds#82 __msan_metadata_ptr_for_load_8 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:92
torvalds#83 0xffffffff814fdb9e in filter_irq_stacks (entries=<optimized out>, nr_entries=4) at kernel/stacktrace.c:397
torvalds#84 0xffffffff829520e8 in stack_depot_save_flags (entries=0xffffffff8620d974 <init_task+1012>, nr_entries=4, alloc_flags=0, depot_flags=0) at lib/stackdepot.c:500
torvalds#85 0xffffffff81b1e560 in __msan_poison_alloca (address=0xffffffff86203da0, size=24, descr=<optimized out>) at mm/kmsan/instrumentation.c:285
torvalds#86 0xffffffff8562821c in _printk (fmt=0xffffffff85f191a5 "\0016Attempting lock1") at kernel/printk/printk.c:2324
torvalds#87 0xffffffff81942aa2 in kmem_cache_create_usercopy (name=0xffffffff85f18903 "mm_struct", size=1296, align=0, flags=270336, useroffset=<optimized out>, usersize=<optimized out>, ctor=0x0 <fixed_percpu_data>) at mm/slab_common.c:296
torvalds#88 0xffffffff86f337a0 in mm_cache_init () at kernel/fork.c:3262
torvalds#89 0xffffffff86eacb8e in start_kernel () at init/main.c:932
torvalds#90 0xffffffff86ecdf94 in x86_64_start_reservations (real_mode_data=0x140e0 <exception_stacks+28896> <error: Cannot access memory at address 0x140e0>) at arch/x86/kernel/head64.c:555
torvalds#91 0xffffffff86ecde9b in x86_64_start_kernel (real_mode_data=0x140e0 <exception_stacks+28896> <error: Cannot access memory at address 0x140e0>) at arch/x86/kernel/head64.c:536
torvalds#92 0xffffffff810001d3 in secondary_startup_64 () at /pool/workspace/linux/arch/x86/kernel/head_64.S:461
torvalds#93 0x0000000000000000 in ??
gyroninja added a commit to gyroninja/linux that referenced this pull request Jan 28, 2024
@gyroninja
[WIP] Disable KMSAN for kernel/rcu/tree
00c2e46 
As of 5ec8e8e(mm/sparsemem: fix race in accessing memory_section->usage) KMSAN
now calls into RCU tree code during kmsan_get_metadata. This will trigger a
write that will reenter into KMSAN getting the system stuck doing infinite
recursion.

#0  kmsan_get_context () at mm/kmsan/kmsan.h:106
#1  __msan_get_context_state () at mm/kmsan/instrumentation.c:331
#2  0xffffffff81495671 in get_current () at ./arch/x86/include/asm/current.h:42
#3  rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
#4  __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
#5  0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#6  pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#7  kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#8  virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#9  0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#10 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#11 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#12 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#13 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#14 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#15 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#16 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#17 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#18 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#19 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#20 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#21 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#22 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#23 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#24 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#25 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#26 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#27 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#28 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#29 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#30 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#31 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#32 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#33 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#34 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#35 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#36 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#37 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#38 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#39 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#40 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#41 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#42 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#43 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#44 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#45 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#46 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#47 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#48 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#49 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#50 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#51 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
#52 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
#53 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#54 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#55 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#56 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#57 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
#58 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#59 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#60 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#61 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#62 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#63 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#64 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#65 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#66 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#67 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff8620d974 <init_task+1012>) at ./arch/x86/include/asm/kmsan.h:82
torvalds#68 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/shadow.c:75
torvalds#69 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff8620d974 <init_task+1012>, is_origin=false) at mm/kmsan/shadow.c:143
#70 kmsan_get_shadow_origin_ptr (address=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/shadow.c:97
torvalds#71 0xffffffff81b1dbd2 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=4, store=false) at mm/kmsan/instrumentation.c:36
torvalds#72 __msan_metadata_ptr_for_load_4 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:91
torvalds#73 0xffffffff8149568f in rcu_preempt_read_enter () at kernel/rcu/tree_plugin.h:379
torvalds#74 __rcu_read_lock () at kernel/rcu/tree_plugin.h:402
torvalds#75 0xffffffff81b2054b in rcu_read_lock () at ./include/linux/rcupdate.h:748
torvalds#76 pfn_valid (pfn=<optimized out>) at ./include/linux/mmzone.h:2016
torvalds#77 kmsan_virt_addr_valid (addr=addr@entry=0xffffffff86203c90) at ./arch/x86/include/asm/kmsan.h:82
torvalds#78 virt_to_page_or_null (vaddr=vaddr@entry=0xffffffff86203c90) at mm/kmsan/shadow.c:75
torvalds#79 0xffffffff81b2023c in kmsan_get_metadata (address=0xffffffff86203c90, is_origin=false) at mm/kmsan/shadow.c:143
torvalds#80 kmsan_get_shadow_origin_ptr (address=0xffffffff86203c90, size=8, store=false) at mm/kmsan/shadow.c:97
torvalds#81 0xffffffff81b1dc72 in get_shadow_origin_ptr (addr=0xffffffff8620d974 <init_task+1012>, size=8, store=false) at mm/kmsan/instrumentation.c:36
torvalds#82 __msan_metadata_ptr_for_load_8 (addr=0xffffffff8620d974 <init_task+1012>) at mm/kmsan/instrumentation.c:92
torvalds#83 0xffffffff814fdb9e in filter_irq_stacks (entries=<optimized out>, nr_entries=4) at kernel/stacktrace.c:397
torvalds#84 0xffffffff829520e8 in stack_depot_save_flags (entries=0xffffffff8620d974 <init_task+1012>, nr_entries=4, alloc_flags=0, depot_flags=0) at lib/stackdepot.c:500
torvalds#85 0xffffffff81b1e560 in __msan_poison_alloca (address=0xffffffff86203da0, size=24, descr=<optimized out>) at mm/kmsan/instrumentation.c:285
torvalds#86 0xffffffff8562821c in _printk (fmt=0xffffffff85f191a5 "\0016Attempting lock1") at kernel/printk/printk.c:2324
torvalds#87 0xffffffff81942aa2 in kmem_cache_create_usercopy (name=0xffffffff85f18903 "mm_struct", size=1296, align=0, flags=270336, useroffset=<optimized out>, usersize=<optimized out>, ctor=0x0 <fixed_percpu_data>) at mm/slab_common.c:296
torvalds#88 0xffffffff86f337a0 in mm_cache_init () at kernel/fork.c:3262
torvalds#89 0xffffffff86eacb8e in start_kernel () at init/main.c:932
torvalds#90 0xffffffff86ecdf94 in x86_64_start_reservations (real_mode_data=0x140e0 <exception_stacks+28896> <error: Cannot access memory at address 0x140e0>) at arch/x86/kernel/head64.c:555
torvalds#91 0xffffffff86ecde9b in x86_64_start_kernel (real_mode_data=0x140e0 <exception_stacks+28896> <error: Cannot access memory at address 0x140e0>) at arch/x86/kernel/head64.c:536
torvalds#92 0xffffffff810001d3 in secondary_startup_64 () at /pool/workspace/linux/arch/x86/kernel/head_64.S:461
torvalds#93 0x0000000000000000 in ??
snajpa pushed a commit to vpsfreecz/linux that referenced this pull request Mar 2, 2024
@zhengchaoshao @snajpa
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
2aef419 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
snajpa pushed a commit to vpsfreecz/linux that referenced this pull request Mar 2, 2024
@zhengchaoshao @snajpa
ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
ed8c311 
[ Upstream commit e2b706c ]

When I perform the following test operations:
1.ip link add br0 type bridge
2.brctl addif br0 eth0
3.ip addr add 239.0.0.1/32 dev eth0
4.ip addr add 239.0.0.1/32 dev br0
5.ip addr add 224.0.0.1/32 dev br0
6.while ((1))
    do
        ifconfig br0 up
        ifconfig br0 down
    done
7.send IGMPv2 query packets to port eth0 continuously. For example,
./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00
1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00"

The preceding tests may trigger the refcnt uaf issue of the mc list. The
stack is as follows:
	refcount_t: addition on 0; use-after-free.
	WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25)
	CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty torvalds#80
	Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
	RIP: 0010:refcount_warn_saturate (lib/refcount.c:25)
	RSP: 0018:ffffb68f00657910 EFLAGS: 00010286
	RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908
	RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900
	RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff
	R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680
	R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00
	FS:  0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000
	CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0
	Call Trace:
	<TASK>
	igmp_heard_query (net/ipv4/igmp.c:1068)
	igmp_rcv (net/ipv4/igmp.c:1132)
	ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205)
	ip_local_deliver_finish (net/ipv4/ip_input.c:234)
	__netif_receive_skb_one_core (net/core/dev.c:5529)
	netif_receive_skb_internal (net/core/dev.c:5729)
	netif_receive_skb (net/core/dev.c:5788)
	br_handle_frame_finish (net/bridge/br_input.c:216)
	nf_hook_bridge_pre (net/bridge/br_input.c:294)
	__netif_receive_skb_core (net/core/dev.c:5423)
	__netif_receive_skb_list_core (net/core/dev.c:5606)
	__netif_receive_skb_list (net/core/dev.c:5674)
	netif_receive_skb_list_internal (net/core/dev.c:5764)
	napi_gro_receive (net/core/gro.c:609)
	e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467)
	e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805)
	__napi_poll (net/core/dev.c:6533)
	net_rx_action (net/core/dev.c:6735)
	__do_softirq (kernel/softirq.c:554)
	run_ksoftirqd (kernel/softirq.c:913)
	smpboot_thread_fn (kernel/smpboot.c:164)
	kthread (kernel/kthread.c:388)
	ret_from_fork (arch/x86/kernel/process.c:153)
	ret_from_fork_asm (arch/x86/entry/entry_64.S:250)
	</TASK>

The root causes are as follows:
Thread A					Thread B
...						netif_receive_skb
br_dev_stop					...
    br_multicast_leave_snoopers			...
        __ip_mc_dec_group			...
            __igmp_group_dropped		igmp_rcv
                igmp_stop_timer			    igmp_heard_query         //ref = 1
                ip_ma_put			        igmp_mod_timer
                    refcount_dec_and_test	            igmp_start_timer //ref = 0
			...                                     refcount_inc //ref increases from 0
When the device receives an IGMPv2 Query message, it starts the timer
immediately, regardless of whether the device is running. If the device is
down and has left the multicast group, it will cause the mc list refcount
uaf issue.

Fixes: 1da177e ("Linux-2.6.12-rc2")
Signed-off-by: Zhengchao Shao <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Reviewed-by: Hangbin Liu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this pull request Jun 19, 2024
@intel-lab-lkp
PCI: vmd: Use raw spinlock for cfg_lock
4367bb8 
If the kernel is built with the following configurations and booting
  CONFIG_VMD=y
  CONFIG_DEBUG_LOCKDEP=y
  CONFIG_DEBUG_SPINLOCK=y
  CONFIG_PROVE_LOCKING=y
  CONFIG_PROVE_RAW_LOCK_NESTING=y

The following log appears,

=============================
[ BUG: Invalid wait context ]
6.10.0-rc4 torvalds#80 Not tainted
-----------------------------
kworker/18:2/633 is trying to lock:
ffff888c474e5648 (&vmd->cfg_lock){....}-{3:3}, at: vmd_pci_write+0x185/0x2a0
other info that might help us debug this:
context-{5:5}
4 locks held by kworker/18:2/633:
 #0: ffff888100108958 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0xf78/0x1920
 #1: ffffc9000ae1fd90 ((work_completion)(&wfc.work)){+.+.}-{0:0}, at: process_one_work+0x7fe/0x1920
 #2: ffff888c483508a8 (&md->mutex){+.+.}-{4:4}, at: __pci_enable_msi_range+0x208/0x800
 #3: ffff888c48329bd8 (&dev->msi_lock){....}-{2:2}, at: pci_msi_update_mask+0x91/0x170
stack backtrace:
CPU: 18 PID: 633 Comm: kworker/18:2 Not tainted 6.10.0-rc4 torvalds#80 7c0f2526417bfbb7579e3c3442683c5961773c75
Hardware name: Lenovo ThinkSystem SR630/-[7X01RCZ000]-, BIOS IVEL60O-2.71 09/28/2020
Workqueue: events work_for_cpu_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0x7c/0xc0
 __lock_acquire+0x9e5/0x1ed0
 lock_acquire+0x194/0x490
 _raw_spin_lock_irqsave+0x42/0x90
 vmd_pci_write+0x185/0x2a0
 pci_msi_update_mask+0x10c/0x170
 __pci_enable_msi_range+0x291/0x800
 pci_alloc_irq_vectors_affinity+0x13e/0x1d0
 pcie_portdrv_probe+0x570/0xe60
 local_pci_probe+0xdc/0x190
 work_for_cpu_fn+0x4e/0xa0
 process_one_work+0x86d/0x1920
 process_scheduled_works+0xd7/0x140
 worker_thread+0x3e9/0xb90
 kthread+0x2e9/0x3d0
 ret_from_fork+0x2d/0x60
 ret_from_fork_asm+0x1a/0x30
 </TASK>

The root cause is that the dev->msi_lock is a raw spinlock, but
vmd->cfg_lock is a spinlock.

Signed-off-by: Jiwei Sun<[email protected]>
Suggested-by: Adrian Huang <[email protected]>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this pull request Jun 25, 2024
@intel-lab-lkp
PCI: vmd: Use raw spinlock for cfg_lock
6b15e5d 
If the kernel is built with the following configurations and booting
  CONFIG_VMD=y
  CONFIG_DEBUG_LOCKDEP=y
  CONFIG_DEBUG_SPINLOCK=y
  CONFIG_PROVE_LOCKING=y
  CONFIG_PROVE_RAW_LOCK_NESTING=y

The following log appears,

=============================
[ BUG: Invalid wait context ]
6.10.0-rc4 torvalds#80 Not tainted
-----------------------------
kworker/18:2/633 is trying to lock:
ffff888c474e5648 (&vmd->cfg_lock){....}-{3:3}, at: vmd_pci_write+0x185/0x2a0
other info that might help us debug this:
context-{5:5}
4 locks held by kworker/18:2/633:
 #0: ffff888100108958 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0xf78/0x1920
 #1: ffffc9000ae1fd90 ((work_completion)(&wfc.work)){+.+.}-{0:0}, at: process_one_work+0x7fe/0x1920
 #2: ffff888c483508a8 (&md->mutex){+.+.}-{4:4}, at: __pci_enable_msi_range+0x208/0x800
 #3: ffff888c48329bd8 (&dev->msi_lock){....}-{2:2}, at: pci_msi_update_mask+0x91/0x170
stack backtrace:
CPU: 18 PID: 633 Comm: kworker/18:2 Not tainted 6.10.0-rc4 torvalds#80 7c0f2526417bfbb7579e3c3442683c5961773c75
Hardware name: Lenovo ThinkSystem SR630/-[7X01RCZ000]-, BIOS IVEL60O-2.71 09/28/2020
Workqueue: events work_for_cpu_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0x7c/0xc0
 __lock_acquire+0x9e5/0x1ed0
 lock_acquire+0x194/0x490
 _raw_spin_lock_irqsave+0x42/0x90
 vmd_pci_write+0x185/0x2a0
 pci_msi_update_mask+0x10c/0x170
 __pci_enable_msi_range+0x291/0x800
 pci_alloc_irq_vectors_affinity+0x13e/0x1d0
 pcie_portdrv_probe+0x570/0xe60
 local_pci_probe+0xdc/0x190
 work_for_cpu_fn+0x4e/0xa0
 process_one_work+0x86d/0x1920
 process_scheduled_works+0xd7/0x140
 worker_thread+0x3e9/0xb90
 kthread+0x2e9/0x3d0
 ret_from_fork+0x2d/0x60
 ret_from_fork_asm+0x1a/0x30
 </TASK>

If CONFIG_PREEMPT_RT is not set, the spinlock_t is based on
raw_spinlock, there is no any question in the above call trace. But if
CONFIG_PREEMPT_RT is set, the spinlock_t is based on rt_mutex, a task
will be scheduled when waiting for rt_mutex. For example, there are two
threads are trying to hold a rt_mutex lock, if A hold the lock firstly,
and B will be scheduled in rtlock_slowlock_locked() waiting for A to
release the lock. The raw_spinlock is a real spinning lock, which is
not allowed the task of the raw_spinlock owner is scheduled in its
critical region. In other words, we should not try to acquire rt_mutex
lock in the critical region of the raw_spinlock when CONFIG_PREEMPT_RT
is set.

CONFIG_PROVE_LOCKING and CONFIG_PROVE_RAW_LOCK_NESTING options are
used to detect the invalid lock nesting (the raw_spinlock vs. spinlock
nesting checks). Here is the call path:

  pci_msi_update_mask  ---> hold raw_spinlock dev->msi_lock
    pci_write_config_dword
     pci_bus_write_config_dword
       vmd_pci_write   ---> hold spinlock_t vmd->cfg_lock

The above call path is the invalid lock nesting becuase the vmd driver
tries to acquire the vmd->cfg_lock spinlock within the raw_spinlock
region (dev->msi_lock). That's why the message "BUG: Invalid wait contex"
is shown.

Signed-off-by: Jiwei Sun<[email protected]>
Suggested-by: Adrian Huang <[email protected]>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this pull request Sep 11, 2024
@htejun
sched_ext: Synchronize bypass state changes with rq lock
750a40d 
While the BPF scheduler is being unloaded, the following warning messages
trigger sometimes:

 NOHZ tick-stop error: local softirq work is pending, handler torvalds#80!!!

This is caused by the CPU entering idle while there are pending softirqs.
The main culprit is the bypassing state assertion not being synchronized
with rq operations. As the BPF scheduler cannot be trusted in the disable
path, the first step is entering the bypass mode where the BPF scheduler is
ignored and scheduling becomes global FIFO.

This is implemented by turning scx_ops_bypassing() true. However, the
transition isn't synchronized against anything and it's possible for enqueue
and dispatch paths to have different ideas on whether bypass mode is on.

Make each rq track its own bypass state with SCX_RQ_BYPASSING which is
modified while rq is locked.

This removes most of the NOHZ tick-stop messages but not completely. I
believe the stragglers are from the sched core bug where pick_task_scx() can
be called without preceding balance_scx(). Once that bug is fixed, we should
verify that all occurrences of this error message are gone too.

v2: scx_enabled() test moved inside the for_each_possible_cpu() loop so that
    the per-cpu states are always synchronized with the global state.

Signed-off-by: Tejun Heo <[email protected]>
Reported-by: David Vernet <[email protected]>
ptr1337 pushed a commit to CachyOS/linux that referenced this pull request Sep 12, 2024
@htejun
sched_ext: Synchronize bypass state changes with rq lock
7a726f7 
While the BPF scheduler is being unloaded, the following warning messages
trigger sometimes:

 NOHZ tick-stop error: local softirq work is pending, handler torvalds#80!!!

This is caused by the CPU entering idle while there are pending softirqs.
The main culprit is the bypassing state assertion not being synchronized
with rq operations. As the BPF scheduler cannot be trusted in the disable
path, the first step is entering the bypass mode where the BPF scheduler is
ignored and scheduling becomes global FIFO.

This is implemented by turning scx_ops_bypassing() true. However, the
transition isn't synchronized against anything and it's possible for enqueue
and dispatch paths to have different ideas on whether bypass mode is on.

Make each rq track its own bypass state with SCX_RQ_BYPASSING which is
modified while rq is locked.

This removes most of the NOHZ tick-stop messages but not completely. I
believe the stragglers are from the sched core bug where pick_task_scx() can
be called without preceding balance_scx(). Once that bug is fixed, we should
verify that all occurrences of this error message are gone too.

v2: scx_enabled() test moved inside the for_each_possible_cpu() loop so that
    the per-cpu states are always synchronized with the global state.

Signed-off-by: Tejun Heo <[email protected]>
Reported-by: David Vernet <[email protected]>
(cherry picked from commit 750a40d)
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this pull request Oct 9, 2024
@intel-lab-lkp
ASoC: qcom: sdm845: add missing soundwire runtime stream alloc
9ada434 
During the migration of Soundwire runtime stream allocation from
the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
soundcard was forgotten.

At this point any playback attempt or audio daemon startup, for instance
on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
NULL dereference:

 Unable to handle kernel NULL pointer dereference at virtual
 address 0000000000000020
 Mem abort info:
   ESR = 0x0000000096000004
   EC = 0x25: DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
   FSC = 0x04: level 0 translation fault
 Data abort info:
   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101ecf000
 [0000000000000020] pgd=0000000000000000, p4d=0000000000000000
 Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
 Modules linked in: ...
 CPU: 5 UID: 0 PID: 1198 Comm: aplay
 Not tainted 6.12.0-rc2-qcomlt-arm64-00059-g9d78f315a362-dirty torvalds#18
 Hardware name: Thundercomm Dragonboard 845c (DT)
 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
 lr : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
 sp : ffff80008a2035c0
 x29: ffff80008a2035c0 x28: ffff80008a203978 x27: 0000000000000000
 x26: 00000000000000c0 x25: 0000000000000000 x24: ffff1676025f4800
 x23: ffff167600ff1cb8 x22: ffff167600ff1c98 x21: 0000000000000003
 x20: ffff167607316000 x19: ffff167604e64e80 x18: 0000000000000000
 x17: 0000000000000000 x16: ffffcec265074160 x15: 0000000000000000
 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
 x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff167600ff1cec
 x5 : ffffcec22cfa2010 x4 : 0000000000000000 x3 : 0000000000000003
 x2 : ffff167613f836c0 x1 : 0000000000000000 x0 : ffff16761feb60b8
 Call trace:
  sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
  wsa881x_hw_params+0x68/0x80 [snd_soc_wsa881x]
  snd_soc_dai_hw_params+0x3c/0xa4
  __soc_pcm_hw_params+0x230/0x660
  dpcm_be_dai_hw_params+0x1d0/0x3f8
  dpcm_fe_dai_hw_params+0x98/0x268
  snd_pcm_hw_params+0x124/0x460
  snd_pcm_common_ioctl+0x998/0x16e8
  snd_pcm_ioctl+0x34/0x58
  __arm64_sys_ioctl+0xac/0xf8
  invoke_syscall+0x48/0x104
  el0_svc_common.constprop.0+0x40/0xe0
  do_el0_svc+0x1c/0x28
  el0_svc+0x34/0xe0
  el0t_64_sync_handler+0x120/0x12c
  el0t_64_sync+0x190/0x194
 Code: aa0403fb f9418400 9100e000 9400102f (f8420f22)
 ---[ end trace 0000000000000000 ]---

0000000000006108 <sdw_stream_add_slave>:
    6108:       d503233f        paciasp
    610c:       a9b97bfd        stp     x29, x30, [sp, #-112]!
    6110:       910003fd        mov     x29, sp
    6114:       a90153f3        stp     x19, x20, [sp, torvalds#16]
    6118:       a9025bf5        stp     x21, x22, [sp, torvalds#32]
    611c:       aa0103f6        mov     x22, x1
    6120:       2a0303f5        mov     w21, w3
    6124:       a90363f7        stp     x23, x24, [sp, torvalds#48]
    6128:       aa0003f8        mov     x24, x0
    612c:       aa0203f7        mov     x23, x2
    6130:       a9046bf9        stp     x25, x26, [sp, torvalds#64]
    6134:       aa0403f9        mov     x25, x4        <-- x4 copied to x25
    6138:       a90573fb        stp     x27, x28, [sp, torvalds#80]
    613c:       aa0403fb        mov     x27, x4
    6140:       f9418400        ldr     x0, [x0, torvalds#776]
    6144:       9100e000        add     x0, x0, #0x38
    6148:       94000000        bl      0 <mutex_lock>
    614c:       f8420f22        ldr     x2, [x25, torvalds#32]!  <-- offset 0x44
    ^^^
This is 0x6108 + offset 0x44 from the beginning of sdw_stream_add_slave()
where data abort happens.
wsa881x_hw_params() is called with stream = NULL and passes it further
in register x4 (5th argument) to sdw_stream_add_slave() without any checks.
Value from x4 is copied to x25 and finally it aborts on trying to load
a value from address in x25 plus offset 32 (in dec) which corresponds
to master_list member in struct sdw_stream_runtime:

struct sdw_stream_runtime {
        const char  *              name;	/*     0     8 */
        struct sdw_stream_params   params;	/*     8    12 */
        enum sdw_stream_state      state;	/*    20     4 */
        enum sdw_stream_type       type;	/*    24     4 */
        /* XXX 4 bytes hole, try to pack */
 here-> struct list_head           master_list;	/*    32    16 */
        int                        m_rt_count;	/*    48     4 */
        /* size: 56, cachelines: 1, members: 6 */
        /* sum members: 48, holes: 1, sum holes: 4 */
        /* padding: 4 */
        /* last cacheline: 56 bytes */

Fix this by adding required calls to qcom_snd_sdw_startup() and
sdw_release_stream() to startup and shutdown routines which restores
the previous correct behaviour when ->set_stream() method is called to
set a valid stream runtime pointer on playback startup.

Reproduced and then fix was tested on db845c RB3 board.

Reported-by: Dmitry Baryshkov <[email protected]>
Cc: [email protected]
Fixes: 15c7fab ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards")
Cc: Srinivas Kandagatla <[email protected]>
Cc: Dmitry Baryshkov <[email protected]>
Cc: Krzysztof Kozlowski <[email protected]>
Cc: Pierre-Louis Bossart <[email protected]>
Signed-off-by: Alexey Klimov <[email protected]>
intel-lab-lkp pushed a commit to intel-lab-lkp/linux that referenced this pull request Oct 10, 2024
@broonie
ASoC: qcom: sdm845: add missing soundwire runtime stream alloc
d0e806b 
During the migration of Soundwire runtime stream allocation from
the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845
soundcard was forgotten.

At this point any playback attempt or audio daemon startup, for instance
on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer
NULL dereference:

 Unable to handle kernel NULL pointer dereference at virtual
 address 0000000000000020
 Mem abort info:
   ESR = 0x0000000096000004
   EC = 0x25: DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
   FSC = 0x04: level 0 translation fault
 Data abort info:
   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101ecf000
 [0000000000000020] pgd=0000000000000000, p4d=0000000000000000
 Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
 Modules linked in: ...
 CPU: 5 UID: 0 PID: 1198 Comm: aplay
 Not tainted 6.12.0-rc2-qcomlt-arm64-00059-g9d78f315a362-dirty torvalds#18
 Hardware name: Thundercomm Dragonboard 845c (DT)
 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
 pc : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
 lr : sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
 sp : ffff80008a2035c0
 x29: ffff80008a2035c0 x28: ffff80008a203978 x27: 0000000000000000
 x26: 00000000000000c0 x25: 0000000000000000 x24: ffff1676025f4800
 x23: ffff167600ff1cb8 x22: ffff167600ff1c98 x21: 0000000000000003
 x20: ffff167607316000 x19: ffff167604e64e80 x18: 0000000000000000
 x17: 0000000000000000 x16: ffffcec265074160 x15: 0000000000000000
 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
 x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff167600ff1cec
 x5 : ffffcec22cfa2010 x4 : 0000000000000000 x3 : 0000000000000003
 x2 : ffff167613f836c0 x1 : 0000000000000000 x0 : ffff16761feb60b8
 Call trace:
  sdw_stream_add_slave+0x44/0x380 [soundwire_bus]
  wsa881x_hw_params+0x68/0x80 [snd_soc_wsa881x]
  snd_soc_dai_hw_params+0x3c/0xa4
  __soc_pcm_hw_params+0x230/0x660
  dpcm_be_dai_hw_params+0x1d0/0x3f8
  dpcm_fe_dai_hw_params+0x98/0x268
  snd_pcm_hw_params+0x124/0x460
  snd_pcm_common_ioctl+0x998/0x16e8
  snd_pcm_ioctl+0x34/0x58
  __arm64_sys_ioctl+0xac/0xf8
  invoke_syscall+0x48/0x104
  el0_svc_common.constprop.0+0x40/0xe0
  do_el0_svc+0x1c/0x28
  el0_svc+0x34/0xe0
  el0t_64_sync_handler+0x120/0x12c
  el0t_64_sync+0x190/0x194
 Code: aa0403fb f9418400 9100e000 9400102f (f8420f22)
 ---[ end trace 0000000000000000 ]---

0000000000006108 <sdw_stream_add_slave>:
    6108:       d503233f        paciasp
    610c:       a9b97bfd        stp     x29, x30, [sp, #-112]!
    6110:       910003fd        mov     x29, sp
    6114:       a90153f3        stp     x19, x20, [sp, torvalds#16]
    6118:       a9025bf5        stp     x21, x22, [sp, torvalds#32]
    611c:       aa0103f6        mov     x22, x1
    6120:       2a0303f5        mov     w21, w3
    6124:       a90363f7        stp     x23, x24, [sp, torvalds#48]
    6128:       aa0003f8        mov     x24, x0
    612c:       aa0203f7        mov     x23, x2
    6130:       a9046bf9        stp     x25, x26, [sp, torvalds#64]
    6134:       aa0403f9        mov     x25, x4        <-- x4 copied to x25
    6138:       a90573fb        stp     x27, x28, [sp, torvalds#80]
    613c:       aa0403fb        mov     x27, x4
    6140:       f9418400        ldr     x0, [x0, torvalds#776]
    6144:       9100e000        add     x0, x0, #0x38
    6148:       94000000        bl      0 <mutex_lock>
    614c:       f8420f22        ldr     x2, [x25, torvalds#32]!  <-- offset 0x44
    ^^^
This is 0x6108 + offset 0x44 from the beginning of sdw_stream_add_slave()
where data abort happens.
wsa881x_hw_params() is called with stream = NULL and passes it further
in register x4 (5th argument) to sdw_stream_add_slave() without any checks.
Value from x4 is copied to x25 and finally it aborts on trying to load
a value from address in x25 plus offset 32 (in dec) which corresponds
to master_list member in struct sdw_stream_runtime:

struct sdw_stream_runtime {
        const char  *              name;	/*     0     8 */
        struct sdw_stream_params   params;	/*     8    12 */
        enum sdw_stream_state      state;	/*    20     4 */
        enum sdw_stream_type       type;	/*    24     4 */
        /* XXX 4 bytes hole, try to pack */
 here-> struct list_head           master_list;	/*    32    16 */
        int                        m_rt_count;	/*    48     4 */
        /* size: 56, cachelines: 1, members: 6 */
        /* sum members: 48, holes: 1, sum holes: 4 */
        /* padding: 4 */
        /* last cacheline: 56 bytes */

Fix this by adding required calls to qcom_snd_sdw_startup() and
sdw_release_stream() to startup and shutdown routines which restores
the previous correct behaviour when ->set_stream() method is called to
set a valid stream runtime pointer on playback startup.

Reproduced and then fix was tested on db845c RB3 board.

Reported-by: Dmitry Baryshkov <[email protected]>
Cc: [email protected]
Fixes: 15c7fab ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards")
Cc: Srinivas Kandagatla <[email protected]>
Cc: Dmitry Baryshkov <[email protected]>
Cc: Krzysztof Kozlowski <[email protected]>
Cc: Pierre-Louis Bossart <[email protected]>
Signed-off-by: Alexey Klimov <[email protected]>
Tested-by: Steev Klimaszewski <[email protected]> # Lenovo Yoga C630
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Reviewed-by: Srinivas Kandagatla <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Mark Brown <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@abak