Pull device mapper fixes from Mike Snitzer:
 "Two stable fixes for dm-cache and one 3.19 DM core fix:

   - fix potential for dm-cache metadata corruption via stale metadata
     buffers being used when switching an inactive cache table to
     active; this could occur due to each table having it's own bufio
     client rather than sharing the client between tables.

   - fix dm-cache target to properly account for discard IO while
     suspending otherwise IO quiescing could complete prematurely.

   - fix DM core's handling of multiple internal suspends by maintaining
     an 'internal_suspend_count' and only resuming the device when this
     count drops to zero"

* tag 'dm-3.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm: fix handling of multiple internal suspends
  dm cache: fix problematic dual use of a single migration count variable
  dm cache: share cache-metadata object across inactive and active DM tables

Pull two block layer fixes from Jens Axboe:
 "Two small patches that should make it into 3.19:

   - a fixup from me for NVMe, making the cq_vector a signed variable.
     Otherwise our -1 comparison fails, and commit 2b25d981 doesn't
     do what it was supposed to.

   - a fixup for the hotplug handling for blk-mq from Ming Lei, using
     the proper kobject referencing to ensure we release resources at
     the right time"

* 'for-linus' of git://git.kernel.dk/linux-block:
  blk-mq: fix hctx/ctx kobject use-after-free
  NVMe: cq_vector should be signed

pULL SCSI fixes from James Bottomley:
 "This consists of four real fixes and three MAINTAINER updates.

  Three of the fixes are obvious (the DIX and atomic allocation are bug
  on and warn on fixes and the other is just trivial) and the ipr one is
  a bit more involved but is required because without it, the card
  double completes aborted commands and causes a kernel oops"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  MAINTAINERS: ibmvscsi driver maintainer change
  MAINTAINERS: ibmvfc driver maintainer change
  MAINTAINERS: Remove self as isci maintainer
  scsi_debug: test always evaluates to false, || should be used instead
  scsi: Avoid crashing if device uses DIX but adapter does not support it
  scsi_debug: use atomic allocation in resp_rsup_opcodes
  ipr: wait for aborted command responses

Pull watchdog fixes from Wim Van Sebroeck:
 "This will fix reboot issues with the imx2_wdt driver and it also drops
  some forgotten owner assignments from platform_drivers"

* git://www.linux-watchdog.org/linux-watchdog:
  watchdog: drop owner assignment from platform_drivers
  watchdog: imx2_wdt: Disable power down counter on boot
  watchdog: imx2_wdt: Improve power management support.

Pull hwmon update from Jean Delvare:
 "This contains a single thing: a new driver for the temperature sensor
  embedded in the Intel 5500/5520/X58 chipsets.

  Sorry for the late request, it's been so long since I last sent a pull
  request and I've been so busy with other tasks meanwhile that I simply
  forgot about these patches.  But given that this is a new driver, it
  can't introduce any regression so I thought it could still be OK.

  This has been in linux-next for months now"

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  hwmon: (i5500_temp) Convert to use ATTRIBUTE_GROUPS macro
  hwmon: (i5500_temp) Convert to module_pci_driver
  hwmon: (i5500_temp) Don't bind to disabled sensors
  hwmon: (i5500_temp) Convert to devm_hwmon_device_register_with_groups
  hwmon: (i5500_temp) New driver for the Intel 5500/5520/X58 chipsets

Pull media fixes from Mauro Carvalho Chehab:
  - fix some race conditions caused by a regression on videobuf2
  - fix a interrupt release bug on cx23885
  - fix support for Mygica T230 and HVR4400
  - fix compilation breakage when USB is not selected on tlg2300
  - fix capabilities report on ompa3isp, soc-camera, rcar_vin and
    pvrusb2

* tag 'media/v3.19-4' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] omap3isp: Correctly set QUERYCAP capabilities
  [media] cx23885: fix free interrupt bug
  [media] pvrusb2: fix missing device_caps in querycap
  [media] vb2: fix vb2_thread_stop race conditions
  [media] rcar_vin: Update device_caps and capabilities in querycap
  [media] soc-camera: fix device capabilities in multiple camera host drivers
  [media] Fix Mygica T230 support
  [media] cx23885: Split Hauppauge WinTV Starburst from HVR4400 card entry
  [media] tlg2300: Fix media dependencies

Commit ffcc3936 ("dm: enhance internal suspend and resume interface")
attempted to handle multiple internal suspends on the same device, but
it did that incorrectly.  When these functions are called in this order
on the same device the device is no longer suspended, but it should be:
	dm_internal_suspend_noflush
	dm_internal_suspend_noflush
	dm_internal_resume

Fix this bug by maintaining an 'internal_suspend_count' and resuming
the device when this count drops to zero.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>

Use ATTRIBUTE_GROUPS macro to simplify the code a bit.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Jean Delvare <jdelvare@suse.de>

Use module_pci_driver to simplify the code a bit.
Signed-off-by: Axel Lin <axel.lin@ingics.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Jean Delvare <jdelvare@suse.de>

On many motherboards, for an unknown reason, the thermal sensor seems
to be disabled and will return a constant temperature value of 36.5
degrees Celsius. Don't bind to the device in that case, so that we
don't report this bogus value to userspace.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: Romain Dolbeau <romain@dolbeau.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>

Use devm_hwmon_device_register_with_groups() to simplify the code a
bit.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Cc: Romain Dolbeau <romain@dolbeau.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>

The Intel 5500, 5520 and X58 chipsets embed a digital thermal sensor.
This new driver supports it.

Note that on many boards the sensor seems to be disabled and reports
the minimum value (36.5 degrees Celsius) all the time.
Signed-off-by: Jean Delvare <jdelvare@suse.de>
Tested-by: Romain Dolbeau <romain@dolbeau.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>

Pull btrfs fixes from Chris Mason:
 "We have a few fixes in my for-linus branch.

  Qu Wenruo's batch fix a regression between some our merge window pull
  and the inode_cache feature.  The rest are smaller bugs"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  btrfs: Don't call btrfs_start_transaction() on frozen fs to avoid deadlock.
  btrfs: Fix the bug that fs_info->pending_changes is never cleared.
  btrfs: fix state->private cast on 32 bit machines
  Btrfs: fix race deleting block group from space_info->ro_bgs list
  Btrfs: fix incorrect freeing in scrub_stripe
  btrfs: sync ioctl, handle errors after transaction start

Merge tag 'platform-drivers-x86-v3.19-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86

Pull platform driver fix from Darren Hart:
 "Revert keyboard backlight sysfs support and documentation.

  The support for the dell-laptop keyboard backlight was flawed and the
  fix:

        https://lkml.org/lkml/2015/1/14/539

  was more invasive that I felt comfortable sending at RC5.

  This series reverts the support for the dell-laptop keyboard backlight
  as well as the documentation for the newly created sysfs attributes.

  We'll get this implemented correctly for 3.20"

* tag 'platform-drivers-x86-v3.19-2' of git://git.infradead.org/users/dvhart/linux-platform-drivers-x86:
  Revert "platform: x86: dell-laptop: Add support for keyboard backlight"
  Revert "Documentation: Add entry for dell-laptop sysfs interface"

Pull PCI fixes from Bjorn Helgaas:
 "These are fixes for:

   - a resource management problem that causes a Radeon "Fatal error
     during GPU init" on machines where the BIOS programmed an invalid
     Root Port window.  This was a regression in v3.16.

   - an Atheros AR93xx device that doesn't handle PCI bus resets
     correctly.  This was a regression in v3.14.

   - an out-of-date email address"

* tag 'pci-v3.19-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  MAINTAINERS: Update Richard Zhu's email address
  sparc/PCI: Clip bridge windows to fit in upstream windows
  powerpc/PCI: Clip bridge windows to fit in upstream windows
  parisc/PCI: Clip bridge windows to fit in upstream windows
  mn10300/PCI: Clip bridge windows to fit in upstream windows
  microblaze/PCI: Clip bridge windows to fit in upstream windows
  ia64/PCI: Clip bridge windows to fit in upstream windows
  frv/PCI: Clip bridge windows to fit in upstream windows
  alpha/PCI: Clip bridge windows to fit in upstream windows
  x86/PCI: Clip bridge windows to fit in upstream windows
  PCI: Add pci_claim_bridge_resource() to clip window if necessary
  PCI: Add pci_bus_clip_resource() to clip to fit upstream window
  PCI: Pass bridge device, not bus, when updating bridge windows
  PCI: Mark Atheros AR93xx to avoid bus reset
  PCI: Add flag for devices where we can't use bus reset

Pull devicetree bug fixes and documentation updates from Grant Likely:
 "A few bugfixes for the new DT overlay feature, documentation updates,
  spelling corrections, and changes to MAINTAINERS.  Nothing earth
  shattering here"

* tag 'devicetree-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/glikely/linux:
  of/unittest: Overlays with sub-devices tests
  of/platform: Handle of_populate drivers in notifier
  of/overlay: Do not generate duplicate nodes
  devicetree: document the "qemu" and "virtio" vendor prefixes
  devicetree: document ARM bindings for QEMU's Firmware Config interface
  Documentation: of: fix typo in graph bindings
  dma-mapping: fix debug print to display correct dma_pfn_offset
  of: replace Asahi Kasei Corp vendor prefix
  ARM: dt: GIC: Spelling s/specific/specifier/, s/flaggs/flags/
  dt/bindings: arm-boards: Spelling s/pointong/pointing/
  MAINTAINERS: Update DT website and git repository
  MAINTAINERS: drop DT regex matching on of_get_property and of_match_table

Pull kvm fixes from Paolo Bonzini:
 "Three small fixes.

  Two for x86 and one avoids that sparse bails out"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: x86: SYSENTER emulation is broken
  KVM: x86: Fix of previously incomplete fix for CVE-2014-8480
  KVM: fix sparse warning in include/trace/events/kvm.h

Pull ARM fixes from Russell King:
 "Another round of small ARM fixes.

  restore_user_regs early stack deallocation is buggy in the presence of
  FIQs which switch to SVC mode, and could lead to corrupted registers
  being returned to a user process given an inopportune FIQ event.

  Another bug was spotted in the ARM perf code where it could lose track
  of perf counter overflows, leading to incorrect perf results.

  Lastly, a bug in arm_add_memory() was spotted where the memory sizes
  aren't properly rounded.  As most people pass properly rounded sizes,
  this hasn't been noticed"

* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  ARM: 8292/1: mm: fix size rounding-down of arm_add_memory() function
  ARM: 8255/1: perf: Prevent wraparound during overflow
  ARM: 8266/1: Remove early stack deallocation from restore_user_regs

Pull two arm64 fixes from Will Deacon:
 "Arm64 fixes seem to come in pairs recently.  We've got a fix for
  removing device-tree blobs when doing a make clean and another one
  addressing a missing include, which fixes build failures in -next for
  allmodconfig (spotted by Mark's buildbot).

  Summary from signed tag:

   - fix cleaning of .dtbs following directory restructuring
   - fix allmodconfig build breakage in -next due to missing include"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: dump: Fix implicit inclusion of definition for PCI_IOBASE
  arm64: Add dtb files to archclean rule

This reverts commit 02b2aaaa.

This interface was determined to be flawed and required too invasive a
fix for the RC cycle. This will be revisited in 3.20.
Signed-off-by: Darren Hart <dvhart@linux.intel.com>

This reverts commit 3161293b.

This interface was determined to be flawed and required too invasive a
fix for the RC cycle. This will be revisited in 3.20.
Signed-off-by: Darren Hart <dvhart@linux.intel.com>

Introduce a new variable to count the number of allocated migration
structures.  The existing variable cache->nr_migrations became
overloaded.  It was used to:

 i) track of the number of migrations in flight for the purposes of
    quiescing during suspend.

 ii) to estimate the amount of background IO occuring.

Recent discard changes meant that REQ_DISCARD bios are processed with
a migration.  Discards are not background IO so nr_migrations was not
incremented.  However this could cause quiescing to complete early.

(i) is now handled with a new variable cache->nr_allocated_migrations.
cache->nr_migrations has been renamed cache->nr_io_migrations.
cleanup_migration() is now called free_io_migration(), since it
decrements that variable.

Also, remove the unused cache->next_migration variable that got replaced
with with prealloc_structs a while ago.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org

If a DM table is reloaded with an inactive table when the device is not
suspended (normal procedure for LVM2), then there will be two dm-bufio
objects that can diverge.  This can lead to a situation where the
inactive table uses bufio to read metadata at the same time the active
table writes metadata -- resulting in the inactive table having stale
metadata buffers once it is promoted to the active table slot.

Fix this by using reference counting and a global list of cache metadata
objects to ensure there is only one metadata object per metadata device.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org

Introduce selftests for overlays using sub-devices present
in children nodes.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

SYSENTER emulation is broken in several ways:
1. It misses the case of 16-bit code segments completely (CVE-2015-0239).
2. MSR_IA32_SYSENTER_CS is checked in 64-bit mode incorrectly (bits 0 and 1 can
   still be set without causing #GP).
3. MSR_IA32_SYSENTER_EIP and MSR_IA32_SYSENTER_ESP are not masked in
   legacy-mode.
4. There is some unneeded code.

Fix it.

Cc: stable@vger.linux.org
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

STR and SLDT with rip-relative operand can cause a host kernel oops.
Mark them as DstMem as well.

Cc: stable@vger.linux.org
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Since c9465b4e (arm64: add support to dump the kernel page tables)
allmodconfig has failed to build on arm64 as a result of:

../arch/arm64/mm/dump.c:55:20: error: 'PCI_IOBASE' undeclared here (not in a function)

Fix this by explicitly including io.h to ensure that a definition is
present.
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>

The old cryptic address bounces, fix it by using a properly working one.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Richard Zhu <Richard.Zhu@freescale.com>

Pull s390 fixes from Martin Schwidefsky:
 "Five more bug fixes from Michael for the s390 BPF jit"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/bpf: Zero extend parameters before calling C function
  s390/bpf: Fix sk_load_byte_msh()
  s390/bpf: Fix offset parameter for skb_copy_bits()
  s390/bpf: Fix skb_copy_bits() parameter passing
  s390/bpf: Fix JMP_JGE_K (A >= K) and JMP_JGT_K (A > K)

Pull one arch/nios2 fix from Ley Foon Tan:
 "Fix kuser trampoline address"

* tag 'nios2-fixes-v3.19-rc6' of git://git.rocketboards.org/linux-socfpga-next:
  nios2: fix kuser trampoline address

Pull module and param fixes from Rusty Russell:
 "Surprising number of fixes this merge window :(

  The first two are minor fallout from the param rework which went in
  this merge window.

  The next three are a series which fixes a longstanding (but never
  previously reported and unlikely , so no CC stable) race between
  kallsyms and freeing the init section.

  Finally, a minor cleanup as our module refcount will now be -1 during
  unload"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux:
  module: make module_refcount() a signed integer.
  module: fix race in kallsyms resolution during module load success.
  module: remove mod arg from module_free, rename module_memfree().
  module_arch_freeing_init(): new hook for archs before module->module_init freed.
  param: fix uninitialized read with CONFIG_DEBUG_LOCK_ALLOC
  param: initialize store function to NULL if not available.

Change maintainer of ibmvscsi driver to Tyrel Datwyler.
Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Acked-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
Cc: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Change maintainer of ibmvfc driver to Tyrel Datwyler.
Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Cc: Nathan Fontenot <nfont@linux.vnet.ibm.com>
Cc: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

Removing myself as a maintainer.
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

cppcheck found the following issue:
(warning) Logical conjunction always evaluates to false:
  alloc_len < 4 && alloc_len > 65535.

..the test should be instead:

  if (alloc_len < 4 || alloc_len > 65536)

This error was introduced by recent commit 38d5c833
("scsi_debug: add Report supported opcodes+tmfs; Compare and write")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

When using overlays with drivers calling of_populate the notifier
will try to create the device twice. Using the populated bit
before proceeding protects against this.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

During the course of the rewrites a bug sneaked in when dealing
with children nodes of overlays, which ends up duplicating
sub nodes.

Simply remove the duplicate traversal of child nodes to fix.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

__kuser_sigtramp address should be 0x1044 instead of 0x1040.
Signed-off-by: Ley Foon Tan <lftan@altera.com>

James Bottomley points out that it will be -1 during unload.  It's
only used for diagnostics, so let's not hide that as it could be a
clue as to what's gone wrong.

Cc: Jason Wessel <jason.wessel@windriver.com>
Acked-and-documention-added-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Masami Hiramatsu <maasami.hiramatsu.pt@hitachi.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

device_caps in struct v4l2_capability were inadequately set in
VIDIOC_QUERYCAP. Fix this. Without this a WARN_ON in the v4l2 core
is triggered. This WARN_ON was added for kernel 3.19 exactly to
detect these situations.
Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>