Pull MIPS updates from Ralf Baechle:
 "Eight fixes across arch/mips.  Nothing stands particuarly out nor is
  complicated but fixes keep coming in at a higher than comfortable
  rate"

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
  MIPS: KVM: Do not sign extend on unsigned MMIO load
  MIPS: BPF: Fix stack pointer allocation
  MIPS: Loongson-3: Fix a cpu-hotplug issue in loongson3_ipi_interrupt()
  MIPS: Fix enabling of DEBUG_STACKOVERFLOW
  MIPS: c-r4k: Fix typo in probe_scache()
  MIPS: Avoid an FPE exception in FCSR mask probing
  MIPS: ath79: Add a missing new line in log message
  MIPS: ralink: Fix clearing the illegal access interrupt

Pull driver core fixes from Greg KH:
 "Here are two fixes for the driver core that resolve some reported
  issues.

  One is a regression from 4.0, the other a fixes a reported oops that
  has been there since 3.19.

  Both have been in linux-next for a while with no problems"

* tag 'driver-core-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  drivers/base: cacheinfo: handle absence of caches
  drivers: of/base: move of_init to driver_init

Pull staging / IIO fixes from Greg KH:
 "Here are some IIO driver fixes to resolve reported issues, some ozwpan
  fixes for some reported CVE problems, and a rtl8712 driver fix for a
  reported regression.

  All have been in linux-next successfully"

* tag 'staging-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8712: fix stack dump
  ozwpan: unchecked signed subtraction leads to DoS
  ozwpan: divide-by-zero leading to panic
  ozwpan: Use unsigned ints to prevent heap overflow
  ozwpan: Use proper check to prevent heap overflow
  iio: adc: twl6030-gpadc: Fix modalias
  iio: adis16400: Fix burst transfer for adis16448
  iio: adis16400: Fix burst mode
  iio: adis16400: Compute the scan mask from channel indices
  iio: adis16400: Use != channel indices for the two voltage channels
  iio: adis16400: Report pressure channel scale

Pull tty/serial driver fixes from Greg KH:
 "Here are a few TTY and Serial driver fixes for reported regressions
  and crashes.

  All of these have been in linux-next with no reported problems"

* tag 'tty-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  n_tty: Fix auditing support for cannonical mode
  serial: 8250_omap: provide complete custom startup & shutdown callbacks
  n_tty: Fix calculation of size in canon_copy_from_read_buf
  serial: imx: Fix DMA handling for IDLE condition aborts
  serial/amba-pl011: Unconditionally poll for FIFO space before each TX char

Pull USB and PHY driver fixes from Greg KH:
 "Here are some USB and PHY driver fixes that resolve some reported
  regressions.  Also in here are some new device ids.

  All of the details are in the shortlog and these patches have been in
  linux-next with no problems"

* tag 'usb-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (22 commits)
  USB: cp210x: add ID for HubZ dual ZigBee and Z-Wave dongle
  usb: renesas_usbhs: Don't disable the pipe if Control write status stage
  usb: renesas_usbhs: Fix fifo unclear in usbhsf_prepare_pop
  usb: gadget: f_fs: fix check in read operation
  usb: musb: fix order of conditions for assigning end point operations
  usb: gadget: f_uac1: check return code from config_ep_by_speed
  usb: gadget: ffs: fix: Always call ffs_closed() in ffs_data_clear()
  usb: gadget: g_ffs: Fix counting of missing_functions
  usb: s3c2410_udc: correct reversed pullup logic
  usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros
  usb: phy: tahvo: Pass the IRQF_ONESHOT flag
  usb: phy: ab8500-usb: Pass the IRQF_ONESHOT flag
  usb: renesas_usbhs: Revise the binding document about the dma-names
  usb: host: xhci: add mutex for non-thread-safe data
  usb: make module xhci_hcd removable
  USB: serial: ftdi_sio: Add support for a Motion Tracker Development Board
  usb: gadget: f_midi: fix segfault when reading empty id
  phy: phy-rcar-gen2: Fix USBHS_UGSTS_LOCK value
  phy: omap-usb2: invoke pm_runtime_disable on error path
  phy: fix Kconfig dependencies
  ...

Pull devicetree fix from Grant Likely:
 "Stupid typo fix for v4.1.  One of the IS_ENABLED() macro calls forgot
  the CONFIG_ prefix.  Only affects a tiny number of platforms, but
  still..."

* tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux:
  of/dynamic: Fix test for PPC_PSERIES

Pull drm fixes from Dave Airlie:
 "i915 has a bunch of fixes, and Russell found a bug in sysfs writing
  handling that results in userspace getting stuck"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm: fix writing to /sys/class/drm/*/status
  drm/i915: Move WaBarrierPerformanceFixDisable:skl to skl code from chv code
  drm/i915: Include G4X/VLV/CHV in self refresh status
  drm/i915: Initialize HWS page address after GPU reset
  drm/i915: Don't skip request retirement if the active list is empty
  drm/i915/hsw: Fix workaround for server AUX channel clock divisor

Pull input subsystem fixes from Dmitry Torokhov:
 "Just a couple touchpad drivers fixups"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: alps - do not reduce trackpoint speed by half
  Input: elantech - add new icbody type
  Input: elantech - fix detection of touchpads where the revision matches a known rate

Pull swiotlb fix from Konrad Rzeszutek Wilk:
 "Tiny little fix which just converts an function to be static.  Really
  tiny"

* 'stable/for-linus-4.1' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/swiotlb:
  swiotlb: do not export map_single function

Pull iBFT fix from Konrad Rzeszutek Wilk:
 "One single fix from Chris to workaround UEFI platforms failing with
  iSCSI IBFT"

* 'stable/for-linus-4.1' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/ibft:
  iscsi_ibft: filter null v4-mapped v6 addresses

Fix possible unintended sign extension in unsigned MMIO loads by casting
to uint16_t in the case of mmio_needed != 2.
Signed-off-by: NNicholas Mc Guire <hofrat@osadl.org>
Reviewed-by: NJames Hogan <james.hogan@imgtec.com>
Tested-by: NJames Hogan <james.hogan@imgtec.com>
Cc: Gleb Natapov <gleb@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: kvm@vger.kernel.org
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/9985/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Fix stack pointer offset which could potentially corrupt
argument registers in the previous frame. The calculated offset
reflects the size of all the registers we need to preserve so there
is no need for this erroneous subtraction.

[ralf@linux-mips.org: Fixed conflict due to only applying this fix part
of the entire series as part of 4.1 fixes.]
Signed-off-by: NMarkos Chandras <markos.chandras@imgtec.com>
Cc: netdev@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexei Starovoitov <ast@plumgrid.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: linux-kernel@vger.kernel.org
Cc: linux-mips@linux-mips.org
Patchwork: http://patchwork.linux-mips.org/patch/10527/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

setup_per_cpu_areas() only setup __per_cpu_offset[] for each possible
cpu, but loongson_sysconf.nr_cpus can be greater than possible cpus
(due to reserved_cpus_mask). So in loongson3_ipi_interrupt(), percpu
access will touch the original varible in .data..percpu section which
has been freed. Without this patch, cpu-hotplug will cause memery
corruption.
Signed-off-by: NHuacai Chen <chenhc@lemote.com>
Cc: John Crispin <john@phrozen.org>
Cc: Steven J. Hill <Steven.Hill@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Fuxin Zhang <zhangfx@lemote.com>
Cc: Zhangjin Wu <wuzhangjin@gmail.com>
Patchwork: http://patchwork.linux-mips.org/patch/10524/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Commit 334c86c4 ("MIPS: IRQ: Add stackoverflow detection") added
kernel stack overflow detection, however it only enabled it conditional
upon the preprocessor definition DEBUG_STACKOVERFLOW, which is never
actually defined. The Kconfig option is called DEBUG_STACKOVERFLOW,
which manifests to the preprocessor as CONFIG_DEBUG_STACKOVERFLOW, so
switch it to using that definition instead.

Fixes: 334c86c4 ("MIPS: IRQ: Add stackoverflow detection")
Signed-off-by: NJames Hogan <james.hogan@imgtec.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Adam Jiang <jiang.adam@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: <stable@vger.kernel.org> # 2.6.37+
Patchwork: http://patchwork.linux-mips.org/patch/10531/Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Fixes a typo in arch/mips/mm/c-r4k.c's probe_scache().
Signed-off-by: NJoshua Kinard <kumba@gentoo.org>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

I've had reports of UEFI platforms failing iSCSI boot in various
configurations, that ended up being caused by network initialization
scripts getting tripped up by unexpected null addresses (0.0.0.0) being
reported for gateways, dhcp servers, and dns servers.

The tianocore EDK2 iSCSI driver generates an iBFT table that always uses
IPv4-mapped IPv6 addresses for the NIC structure fields.  This results
in values that are "not present or not specified" being reported as
::ffff:0.0.0.0 rather than all zeros as specified.

The iscsi_ibft module filters unspecified fields from the iBFT from
sysfs, preventing userspace from using invalid values and making it easy
to check for the presence of a value.  This currently fails in regard to
these mapped null addresses.

In order to remain consistent with how the iBFT information is exposed,
we should accommodate the behavior of the tianocore iSCSI driver as it's
already in the wild in a large number of servers.

Tested under qemu using an OVMF build of tianocore EDK2.
Signed-off-by: NChris Leech <cleech@redhat.com>
Reviewed-by: NMike Christie <michaelc@cs.wisc.edu>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

The map_single() function is not defined as static, even though it
doesn't seem to be used anywhere else in the kernel. Make it static to
avoid namespace pollution since this is a rather generic symbol.
Signed-off-by: NAlexandre Courbot <acourbot@nvidia.com>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Writing to a file is supposed to return the number of bytes written.
Returning zero unfortunately causes bash to constantly spin trying
to write to the sysfs file, to such an extent that even ^c and ^z
have no effect.  The only way out of that is to kill the shell and
log back in.  This isn't nice behaviour.

Fix it by returning the number of characters written to sysfs files.

[airlied: used suggestion from Al Viro]
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>
Reviewed-by: NChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: NDave Airlie <airlied@redhat.com>

bunch of i915 fixes.
* tag 'drm-intel-fixes-2015-06-05' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Move WaBarrierPerformanceFixDisable:skl to skl code from chv code
  drm/i915: Include G4X/VLV/CHV in self refresh status
  drm/i915: Initialize HWS page address after GPU reset
  drm/i915: Don't skip request retirement if the active list is empty
  drm/i915/hsw: Fix workaround for server AUX channel clock divisor

Pull PCI fixes from Bjorn Helgaas:
 "Resource management
   - Fix IOV sorting by alignment (Wei Yang)
   - Preserve resource size during alignment reordering (Yinghai Lu)

  Miscellaneous
    - MAINTAINERS: Add Pratyush for SPEAr13xx and DesignWare PCIe (Pratyush Anand)"

* tag 'pci-v4.1-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  PCI: Preserve resource size during alignment reordering
  PCI: Fix IOV resource sorting by alignment requirement
  MAINTAINERS: Add Pratyush Anand as SPEAr13xx and DesignWare PCIe maintainer

Pull sound fixes from Takashi Iwai:
 "It was a fairly calm week; here you can find only a few trivial quirks
  and fixes for USB and HD-audio.  All changes are pretty device
  specific"

* tag 'sound-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: usb-audio: fix missing input volume controls in MAYA44 USB(+)
  ALSA: usb-audio: add MAYA44 USB+ mixer control names
  ALSA: hda/realtek - Add a fixup for another Acer Aspire 9420
  ALSA: hda - Fix jack detection at resume with VT codecs
  ALSA: usb-audio: don't try to get Outlaw RR2150 sample rate
  ALSA: usb-audio: Add mic volume fix quirk for Logitech Quickcam Fusion
  ALSA: hda/realtek - Suooprt Dell headset mode for ALC256

Pull iommu fix from Joerg Roedel:
 "Only one patch:

   - Revert "iommu/amd: Don't allocate with __GFP_ZERO in
     alloc_coherent".

     This patch caused problems with some drivers, so it is better to
     revert it now until the drivers have been fixed"

* tag 'iommu-fixes-v4.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  Revert "iommu/amd: Don't allocate with __GFP_ZERO in alloc_coherent"

Pull x86 fixes from Ingo Molnar:
 "Misc fixes:

   - early_idt_handlers[] fix that fixes the build with bleeding edge
     tooling

   - build warning fix on GCC 5.1

   - vm86 fix plus self-test to make it harder to break it again"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/asm/irq: Stop relying on magic JMP behavior for early_idt_handlers
  x86/asm/entry/32, selftests: Add a selftest for kernel entries from VM86 mode
  x86/boot: Add CONFIG_PARAVIRT_SPINLOCKS quirk to arch/x86/boot/compressed/misc.h
  x86/asm/entry/32: Really make user_mode() work correctly for VM86 mode

Pull perf fixes from Ingo Molnar:
 "The biggest chunk of the changes are two regression fixes: a HT
  workaround fix and an event-group scheduling fix.  It's been verified
  with 5 days of fuzzer testing.

  Other fixes:

   - eBPF fix
   - a BIOS breakage detection fix
   - PMU driver fixes"

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/intel/pt: Fix a refactoring bug
  perf/x86: Tweak broken BIOS rules during check_hw_exists()
  perf/x86/intel/pt: Untangle pt_buffer_reset_markers()
  perf: Disallow sparse AUX allocations for non-SG PMUs in overwrite mode
  perf/x86: Improve HT workaround GP counter constraint
  perf/x86: Fix event/group validation
  perf: Fix race in BPF program unregister

Pull drm fixes from Dave Airlie:
 "Just two small fixes: one radeon, one amdkfd"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/amdkfd: fix topology bug with capability attr.
  drm/radeon: use proper ACR regisiter for DCE3.2

Pull i2c bug fixes from Wolfram Sang:
 "Two small bugfixes for I2C"

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: s3c2410: fix oops in suspend callback for non-dt platforms
  i2c: hix5hd2: Fix modalias to make module auto-loading work

Merge tag 'usb-serial-4.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus

Johan writes:

USB-serial fixes for v4.1-rc7

Here are a couple of new device ids.
Signed-off-by: NJohan Hovold <johan@kernel.org>

On some v7 devices (e.g. Lenovo-E550) the deltas reported are typically
only in the 0-1 range dividing this by 2 results in a range of 0-0.

And even for v7 devices where this does not lead to making the trackstick
entirely unusable, it makes it twice as slow as before we added v7 support
and were using the ps/2 mouse emulation of the dual point setup.

If some kind of generic slowdown is actually necessary for some devices,
then that belongs in userspace, not in the kernel.

Cc: stable@vger.kernel.org
Reported-and-tested-by: NRico Moorman <rico.moorman@gmail.com>
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Reviewed-by: NBenjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

This adds new icbody type to the list recognized by Elantech PS/2 driver.

Cc: stable@vger.kernel.org
Signed-off-by: NSam Hung <sam.hung@emc.com.tw>
Signed-off-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

"IS_ENABLED(PPC_PSERIES)" always evaluates to false, as IS_ENABLED() is
supposed to be used with the full Kconfig symbol name, including the
"CONFIG_" prefix.

Add the missing "CONFIG_" prefix to fix this.

Fixes: a25095d4 ("of: Move dynamic node fixups out of powerpc and into common code")
Signed-off-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Cc: stable@vger.kernel.org #+3.17
Signed-off-by: NGrant Likely <grant.likely@linaro.org>

In the functions compat_get_bitmap() and compat_put_bitmap() the
variable nr_compat_longs stores how many compat_ulong_t words should be
copied in a loop.

The copy loop itself is this:
  if (nr_compat_longs-- > 0) {
      if (__get_user(um, umask)) return -EFAULT;
  } else {
      um = 0;
  }

Since nr_compat_longs gets unconditionally decremented in each loop and
since it's type is unsigned this could theoretically lead to out of
bounds accesses to userspace if nr_compat_longs wraps around to
(unsigned)(-1).

Although the callers currently do not trigger out-of-bounds accesses, we
should better implement the loop in a safe way to completely avoid such
warp-arounds.
Signed-off-by: NHelge Deller <deller@gmx.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>

Added the USB serial device ID for the HubZ dual ZigBee
and Z-Wave radio dongle.
Signed-off-by: NJohn D. Blair <johnb@candicontrols.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NJohan Hovold <johan@kernel.org>

Pull dmaengine fixes from Vinod Koul:
 "We have two small fixes:

   - pl330 termination hang fix by Krzysztof

   - hsu memory leak fix by Peter"

* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
  dmaengine: hsu: Fix memory leak when stopping a running transfer
  dmaengine: pl330: Fix hang on dmaengine_terminate_all on certain boards

Commit 066450be ("perf/x86/intel/pt: Clean up the control flow
in pt_pmu_hw_init()") changed attribute initialization so that
only the first attribute gets initialized using
sysfs_attr_init(), which upsets lockdep.

This patch fixes the glitch so that all allocated attributes are
properly initialized thus fixing the lockdep warning reported by
Tvrtko and Imre.
Reported-by: NTvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Reported-by: NImre Deak <imre.deak@intel.com>
Signed-off-by: NAlexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: <linux-kernel@vger.kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: NIngo Molnar <mingo@kernel.org>

 commit 65ca7514
 Author: Damien Lespiau <damien.lespiau@intel.com>
 Date:   Mon Feb 9 19:33:22 2015 +0000

    drm/i915/skl: Implement WaBarrierPerformanceFixDisable

got misapplied and the code landed in chv_init_workarounds() instead of
the intended skl_init_workarounds(). Move it over to the right place.

Cc: Damien Lespiau <damien.lespiau@intel.com>
Signed-off-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
Reviewed-by: NDamien Lespiau <damien.lespiau@intel.com>
Reviewed-by: NBen Widawsky <ben@bwidawsk.net>
Signed-off-by: NJani Nikula <jani.nikula@intel.com>

Add all missing platforms handled by intel_set_memory_cxsr() to the
i915_sr_status debugfs entry.

v2: Add G4X too. (Ville)
    Clarify the change also affects CHV. (Ander)

References: https://bugs.freedesktop.org/show_bug.cgi?id=89792Signed-off-by: NAnder Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
Reviewed-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: NJani Nikula <jani.nikula@intel.com>

After GPU reset, HW is losing the address of HWS page in the register.
The page itself is valid except that HW is not aware of its location.

[   64.368623] [drm:gen8_init_common_ring [i915]] *ERROR* HWS Page address = 0x00000000
[   64.368655] [drm:gen8_init_common_ring [i915]] *ERROR* HWS Page address = 0x00000000
[   64.368681] [drm:gen8_init_common_ring [i915]] *ERROR* HWS Page address = 0x00000000
[   64.368704] [drm:gen8_init_common_ring [i915]] *ERROR* HWS Page address = 0x00000000

This patch reloads this value into the register during ring init.
Signed-off-by: NArun Siluvery <arun.siluvery@linux.intel.com>
Reviewed-by: NVille Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: NJani Nikula <jani.nikula@intel.com>

Merge tag 'drm-amdkfd-fixes-2015-06-03' of git://people.freedesktop.org/~gabbayo/linux into drm-fixes

One minor fix for last -rc of 4.1. The fix moves the update of an attribute in
topology to *after* it is actually initialized.

* tag 'drm-amdkfd-fixes-2015-06-03' of git://people.freedesktop.org/~gabbayo/linux:
  drm/amdkfd: fix topology bug with capability attr.

One more small r7xx audio regression fix for 4.1

* 'drm-fixes-4.1' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: use proper ACR regisiter for DCE3.2