acpi_video_handles_brightness_key_presses()'s may return false if the i915
driver is not loaded yet when thinkpad_acpi loads, and then return true
after the i915 driver has loaded. This means that thinkpad_acpi cannot
use it as is since thinkpad_acpi caches the return value.

This reverts commit 7714687a ("thinkpad_acpi: Use
acpi_video_handles_brightness_key_presses()").

Fixes: 7714687a "thinkpad_acpi: Use acpi_video_handles_brightness_key_presses()"
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Darren Hart <dvhart@linux.intel.com>
Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Document that acpi_video_handles_brightness_key_presses()'s return value
may change over time and should not be cached.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

ACPI / video: Fix using an uninitialized mutex / list_head in acpi_video_handles_brightness_key_presses()

If acpi_video_handles_brightness_key_presses() was called before
acpi_video_register(), it would use the video_list mutex / list_head
uninitialized.

This patch fixes this by using DEFINE_MUTEX / LIST_HEAD when declaring
these, instead of initializing them runtime from acpi_video_register().

Fixes: 90b066b1 "ACPI / video: Add a acpi_video_handles_brightness_key_presses() helper"
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

On systems with an intel video opcode region, the completion used in the
patch this commit reverts will only complete if the i915 driver loads.

If for some reason the i915 driver never loads calls to
acpi_video_handles_brightness_key_presses() may be delayed indefinitely.

This reverts commit aecbd9b1 ("ACPI / video: driver must be registered
before checking for keypresses") fixing this.

This reintroduces a potential NULL pointer deref due to using an
uninitalized mutex, this is fixed differently in a follow-up patch.

Fixes: aecbd9b1 (ACPI / video: driver must be registered before checking for keypresses)
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

The Toshiba Portege R700 needs disable_backlight_sysfs_if=1, just like
the Toshiba Portege R830. Add a quirk for this.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=21012
Cc: 4.2+ <stable@vger.kernel.org> # 4.2+
Tested-by: Emma Reisz <emmareisz@outlook.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

acpi_video_handles_brightness_key_presses() may use an uninitialized mutex.
The error has been reported by lockdep: DEBUG_LOCKS_WARN_ON(l->magic != l).
The function assumes that the video driver has been registered before being
called. As explained in the comment of acpi_video_init(), the registration
of the video class may be defered and thus may not take place in the init
function of the module.

Use completion mechanisms to make sure that
acpi_video_handles_brightness_key_presses() wait for the completion of
acpi_video_register() before using the mutex.
Also get rid of register_count since task completion can replace it.
Signed-off-by: Adrien Schildknecht <adrien+dev@schischi.me>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

The native interface on SAMSUNG 530U4E/540U4E doesn't work even though
the firmware claims Win8 compatible while the acpi_video interface
works, add a quirk for this.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=108971Reported-and-tested-by: adam bk <adamdd55@gmail.com>
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

The Dell Vostro V131 has an especially broken acpi-video implementation.

The backlight control bits work, but when the brightness is changed via
the acpi-video interface the backlight flickers annoyingly before settling
at the new brightness, switching to using the native interface fixes the
flickering so add a quirk for this (the vendor interface has the same
problem).

Brightness keypresses reported through the acpi-video-bus are also broken,
they get reported one event delayed, so if you press the brightness-up
hotkey on the keyboard nothing happens, then if you press brightness-down,
the previous brightness-up event gets reported. Since the keypresses are
also reported via wmi (if active) and via atkbd (when wmi is not active)
add a quirk to simply filter out the delayed (broken) events.
Reported-and-tested-by: Michał Kępień <kernel@kempniu.pl>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Add a module option to disable the reporting of keypresses, in some buggy
firmware implementatinon, the reported events are wrong. E.g. they lag
reality by one event in the case triggering the writing of this patch.

In this case it is better to not forward these wrong events to userspace
(esp.) when there is another source of the same events which is not buggy.

Note this is only intended to work around implementations which send
events which are plain wrong. In some cases we get double events, e.g.
from both acpi-video and the atkbd driver, in this case acpi-video is
considered the canonical source, and the events from the other source
should be filtered (using e.g. /lib/udev/hwdb.d/60-keyboard.hwdb).
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Use the new acpi_video_handles_brightness_key_presses function to check
if we should report brightness key-presses.

This makes the code both easier to read and makes it properly report
key-presses when acpi-video is not reporting them for reasons other
then the backlight type being vendor.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Use the new acpi_video_handles_brightness_key_presses function to check
if we should report brightness key-presses.

This makes the code both easier to read and makes it properly report
key-presses when acpi-video is not reporting them for reasons other
then the backlight type being vendor.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Several drivers want to know if the acpi-video is generating key-presses
for brightness change hotkeys to avoid sending double key-events to
userspace for these. Currently these driver use this construct for this:

	if (acpi_video_get_backlight_type() == acpi_backlight_vendor)
		report_brightness_key_event();

This indirect way of detecting if acpi-video is active does not make the
code easier to understand, and in some cases it is wrong because just
because the preferred type != vendor does not mean that acpi-video is
actually listening for brightness events, e.g. there may be no acpi-video
bus on the system at all.

This commit adds a acpi_video_handles_brightness_key_presses() helper
function, making the code needing this functionality both easier to read
and more correct.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

Pull MIPS fixes from Ralf Baechle:

 - Fix bitrot in __get_user_unaligned()
 - EVA userspace accessor bug fixes.
 - Fix for build issues with certain toolchains.
 - Fix build error for VDSO with particular toolchain versions.
 - Fix build error due to a variable that should have been removed by an
   earlier patch

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
  MIPS: Fix bitrot in __get_user_unaligned()
  MIPS: Fix build error due to unused variables.
  MIPS: VDSO: Fix build error
  MIPS: CPS: drop .set mips64r2 directives
  MIPS: uaccess: Take EVA into account in [__]clear_user
  MIPS: uaccess: Take EVA into account in __copy_from_user()
  MIPS: uaccess: Fix strlen_user with EVA

Pull ARM SoC fixes from Olof Johansson:
 "A smallish set of fixes that we've been sitting on for a while now,
  flushing the queue here so they go in.  Summary:

  A handful of fixes for OMAP, i.MX, Allwinner and Tegra:

   - A clock rate and a PHY setup fix for i.MX6Q/DL
   - A couple of fixes for the reduced serial bus (sunxi-rsb) on
     Allwinner
   - UART wakeirq fix for an OMAP4 board, timer config fixes for AM43XX.
   - Suspend fix for Tegra124 Chromebooks
   - Fix for missing implicit include that's different between
     ARM/ARM64"

* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: tegra: Fix suspend hang on Tegra124 Chromebooks
  bus: sunxi-rsb: Fix peripheral IC mapping runtime address
  bus: sunxi-rsb: Fix primary PMIC mapping hardware address
  ARM: dts: Fix UART wakeirq for omap4 duovero parlor
  ARM: OMAP2+: AM43xx: select ARM TWD timer
  ARM: OMAP2+: am43xx: enable GENERIC_CLOCKEVENTS_BROADCAST
  fsl-ifc: add missing include on ARM64
  ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards
  ARM: dts: imx: Fix the assigned-clock mismatch issue on imx6q/dl
  bus: sunxi-rsb: unlock on error in sunxi_rsb_read()
  ARM: dts: sunxi: sun6i-a31s-primo81.dts: add touchscreen axis swapping property

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Pull power management and ACPI fixes from Rafael Wysocki:
 "These fix an ACPI processor driver regression introduced during the
  4.3 cycle and a mistake in the recently added SCPI support in the
  arm_big_little cpufreq driver.

  Specifics:

   - Fix a thermal management issue introduced by an ACPI processor
     driver change made during the 4.3 development cycle that failed to
     return 0 from a function on success which triggered an error
     cleanup path every time it had been called that deleted useful data
     structures created previously (Srinivas Pandruvada).

   - Fix a variable data type issue in the arm_big_little cpufreq
     driver's SCPI support code added recently that prevents error
     handling in there from working correctly (Dan Carpenter)"

* tag 'pm+acpi-4.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq: scpi-cpufreq: signedness bug in scpi_get_dvfs_info()
  ACPI / processor: Fix thermal cooling device regression

Pull md bugfix from Neil Brown:
 "One more md fix for 4.4-rc

  Fix a regression which causes reshape to not start properly sometimes"

* tag 'md/4.4-rc6-fix' of git://neil.brown.name/md:
  md: remove check for MD_RECOVERY_NEEDED in action_store.

Pull UBI bug fixes from Richard Weinberger:
 "This contains four bug fixes for UBI"

* tag 'upstream-4.4-rc7' of git://git.infradead.org/linux-ubifs:
  mtd: ubi: don't leak e if schedule_erase() fails
  mtd: ubi: fixup error correction in do_sync_erase()
  UBI: fix use of "VID" vs. "EC" in header self-check
  UBI: fix return error code

Pull ftrace/recordmcount fix from Steven Rostedt:
 "Russell King was reporting lots of warnings when he compiled his
  kernel with ftrace enabled.  With some investigation it was discovered
  that it was his compile setup.  He was using ccache with hard links,
  which allowed recordmcount to process the same .o twice.  When this
  happens, recordmcount will detect that it was already done and give a
  warning about it.

  Russell fixed this by having recordmcount detect that the object file
  has more than one hard link, and if it does, it unlinks the object
  file after it maps it and processes then.  This appears to fix the
  issue.

  As you did not like the fact that recordmcount modified the file in
  place and thought that it should do the modifications in memory and
  then write it out to disk and move it over the old file to prevent
  other more subtle issues like the one above, a second patch is added
  on top of Russell's to do just that.  Luckily the original code had
  write and lseek wrappers that I was able to modify to not do inplace
  writes, but simply keep track of the changes made in memory.  When a
  write is made, a "update" flag is set, and at the end of processing,
  if the update is set, then it writes the file with changes out to a
  new file, and then renames it over the original one.

  The file descriptor is still passed to the write and lseek wrappers
  because removing that would cause the change to be more intrusive.
  That can be removed in a follow up cleanup patch that can wait till
  the next merge window"

* tag 'trace-v4.4-rc4-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  ftrace/scripts: Have recordmcount copy the object file
  scripts: recordmcount: break hardlinks

Pull ARC fixes from Vineet Gupta:
 "Sorry for this late pull request, but these are all important fixes
  for code introduced/updated in this release which we will otherwise
  end up back porting.

   - Unwinder rework (A revert followed by better fix)
   - Build errors: MMUv2, modules with -Os
   - highmem section mismatch build splat"

* tag 'arc-4.4-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
  ARC: dw2 unwind: Catch Dwarf SNAFUs early
  ARC: dw2 unwind: Don't bail for CIE.version != 1
  Revert "ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing"
  ARC: Fix linking errors with CONFIG_MODULE + CONFIG_CC_OPTIMIZE_FOR_SIZE
  ARC: mm: fix building for MMU v2
  ARC: mm: HIGHMEM: Fix section mismatch splat

* acpi-processor:
  ACPI / processor: Fix thermal cooling device regression

* pm-cpufreq:
  cpufreq: scpi-cpufreq: signedness bug in scpi_get_dvfs_info()

Pull parisc system call restart fix from Helge Deller:
 "The architectural design of parisc always uses two instructions to
  call kernel syscalls (delayed branch feature).  This means that the
  instruction following the branch (located in the delay slot of the
  branch instruction) is executed before control passes to the branch
  destination.

  Depending on which assembler instruction and how it is used in
  usersapce in the delay slot, this sometimes made restarted syscalls
  like futex() and poll() failing with -ENOSYS"

* 'parisc-4.4-4' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: Fix syscall restarts

Pull sparc fixes from David Miller:

 1) Finally make perf stack backtraces stable on sparc, several problems
    (mostly due to the context in which the user copies from the stack
    are done) contributed to this.

    From Rob Gardner.

 2) Export ADI capability if the cpu supports it.

 3) Hook up userfaultfd system call.

 4) When faults happen during user copies we really have to clean up and
    restore the FPU state fully.  Also from Rob Gardner

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
  tty/serial: Skip 'NULL' char after console break when sysrq enabled
  sparc64: fix FP corruption in user copy functions
  sparc64: Perf should save/restore fault info
  sparc64: Ensure perf can access user stacks
  sparc64: Don't set %pil in rtrap_nmi too early
  sparc64: Add ADI capability to cpu capabilities
  tty: serial: constify sunhv_ops structs
  sparc: Hook up userfaultfd system call

When sysrq is triggered from console, serial driver for SUN hypervisor
console receives a console break and enables the sysrq. It expects a valid
sysrq char following with break. Meanwhile if driver receives 'NULL'
ASCII char then it disables sysrq and sysrq handler will never be invoked.

This fix skips calling uart sysrq handler when 'NULL' is received while
sysrq is enabled.
Signed-off-by: Vijay Kumar <vijay.ac.kumar@oracle.com>
Acked-by: Karl Volz <karl.volz@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Short story: Exception handlers used by some copy_to_user() and
copy_from_user() functions do not diligently clean up floating point
register usage, and this can result in a user process seeing invalid
values in floating point registers. This sometimes makes the process
fail.

Long story: Several cpu-specific (NG4, NG2, U1, U3) memcpy functions
use floating point registers and VIS alignaddr/faligndata to
accelerate data copying when source and dest addresses don't align
well. Linux uses a lazy scheme for saving floating point registers; It
is not done upon entering the kernel since it's a very expensive
operation. Rather, it is done only when needed. If the kernel ends up
not using FP regs during the course of some trap or system call, then
it can return to user space without saving or restoring them.

The various memcpy functions begin their FP code with VISEntry (or a
variation thereof), which saves the FP regs. They conclude their FP
code with VISExit (or a variation) which essentially marks the FP regs
"clean", ie, they contain no unsaved values. fprs.FPRS_FEF is turned
off so that a lazy restore will be triggered when/if the user process
accesses floating point regs again.

The bug is that the user copy variants of memcpy, copy_from_user() and
copy_to_user(), employ an exception handling mechanism to detect faults
when accessing user space addresses, and when this handler is invoked,
an immediate return from the function is forced, and VISExit is not
executed, thus leaving the fprs register in an indeterminate state,
but often with fprs.FPRS_FEF set and one or more dirty bits. This
results in a return to user space with invalid values in the FP regs,
and since fprs.FPRS_FEF is on, no lazy restore occurs.

This bug affects copy_to_user() and copy_from_user() for NG4, NG2,
U3, and U1. All are fixed by using a new exception handler for those
loads and stores that are done during the time between VISEnter and
VISExit.

n.b. In NG4memcpy, the problematic code can be triggered by a copy
size greater than 128 bytes and an unaligned source address.  This bug
is known to be the cause of random user process memory corruptions
while perf is running with the callgraph option (ie, perf record -g).
This occurs because perf uses copy_from_user() to read user stacks,
and may fault when it follows a stack frame pointer off to an
invalid page. Validation checks on the stack address just obscure
the underlying problem.
Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

There have been several reports of random processes being killed with
a bus error or segfault during userspace stack walking in perf.  One
of the root causes of this problem is an asynchronous modification to
thread_info fault_address and fault_code, which stems from a perf
counter interrupt arriving during kernel processing of a "benign"
fault, such as a TSB miss. Since perf_callchain_user() invokes
copy_from_user() to read user stacks, a fault is not only possible,
but probable. Validity checks on the stack address merely cover up the
problem and reduce its frequency.

The solution here is to save and restore fault_address and fault_code
in perf_callchain_user() so that the benign fault handler is not
disturbed by a perf interrupt.
Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

When an interrupt (such as a perf counter interrupt) is delivered
while executing in user space, the trap entry code puts ASI_AIUS in
%asi so that copy_from_user() and copy_to_user() will access the
correct memory. But if a perf counter interrupt is delivered while the
cpu is already executing in kernel space, then the trap entry code
will put ASI_P in %asi, and this will prevent copy_from_user() from
reading any useful stack data in either of the perf_callchain_user_X
functions, and thus no user callgraph data will be collected for this
sample period. An additional problem is that a fault is guaranteed
to occur, and though it will be silently covered up, it wastes time
and could perturb state.

In perf_callchain_user(), we ensure that %asi contains ASI_AIUS
because we know for a fact that the subsequent calls to
copy_from_user() are intended to read the user's stack.

[ Use get_fs()/set_fs() -DaveM ]
Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 28a1f533 delays setting %pil to avoid potential
hardirq stack overflow in the common rtrap_irq path.
Setting %pil also needs to be delayed in the rtrap_nmi
path for the same reason.
Signed-off-by: Rob Gardner <rob.gardner@oracle.com>
Signed-off-by: Dave Aldridge <david.j.aldridge@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Add ADI (Application Data Integrity) capability to cpu capabilities list.
ADI capability allows virtual addresses to be encoded with a tag in
bits 63-60. This tag serves as an access control key for the regions
of virtual address with ADI enabled and a key set on them. Hypervisor
encodes this capability as "adp" in "hwcap-list" property in machine
description.
Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Constifies sunhv_ops structures in tty's serial
driver since they are not modified after their
initialization.

Detected and found using Coccinelle.
Suggested-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Aya Mahfouz <mahfouz.saif.elyazal@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The "domain" variable needs to be signed for the error handling to work.

Fixes: 8def3103 (cpufreq: arm_big_little: add SCPI interface driver)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Acked-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

After hooking up system call, userfaultfd selftest was successful for
both 32 and 64 bit version of test.
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull sound fixes from Takashi Iwai:
 "This shouldn't be a nightmare before Christmas: just a handful small
  device-specific fixes for various ASoC and HD-audio drivers.  Most of
  them are stable fixes"

* tag 'sound-4.4-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)
  ASoC: fsl_sai: fix no frame clk in master mode
  ALSA: hda - Set SKL+ hda controller power at freeze() and thaw()
  ASoC: sgtl5000: fix VAG power up timing
  ASoC: rockchip: spdif: Set transmit data level to 16 samples
  ASoC: wm8974: set cache type for regmap
  ASoC: es8328: Fix shifts for mixer switches
  ASoC: davinci-mcasp: Fix XDATA check in mcasp_start_tx
  ASoC: es8328: Fix deemphasis values

Pull i915 drm fixes from Jani Nikula:
 "Here's a batch of i915 fixes all around.  It may be slightly bigger
  than one would hope for at this stage, but they've all been through
  testing in our -next before being picked up for v4.4.  Also, I missed
  Dave's fixes pull earlier today just because I wanted an extra testing
  round on this.  So I'm fairly confident.

  Wishing you all the things it is customary to wish this time of the
  year"

* tag 'drm-intel-fixes-2015-12-23' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Correct max delay for HDMI hotplug live status checking
  drm/i915: mdelay(10) considered harmful
  drm/i915: Kill intel_crtc->cursor_bo
  drm/i915: Workaround CHV pipe C cursor fail
  drm/i915: Only spin whilst waiting on the current request
  drm/i915: Limit the busy wait on requests to 5us not 10ms!
  drm/i915: Break busywaiting for requests on pending signals
  drm/i915: Disable primary plane if we fail to reconstruct BIOS fb (v2)
  drm/i915: Set the map-and-fenceable flag for preallocated objects
  drm/i915: Drop the broken cursor base==0 special casing

Pull drm fixes from Dave Airlie:
 "Not much happening, should have dequeued this lot earlier.

  One amdgpu, one nouveau and one exynos fix"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/exynos: atomic check only enabled crtc states
  drm/nouveau/bios/fan: hardcode the fan mode to linear
  drm/amdgpu: fix user fence handling

Merge tag 'asoc-fix-v4.4-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v4.4

A collection of small driver specific fixes here, nothing that'll affect
users who don't have the devices concerned.  At least the wm8974 bug
indicates that there's not too many users of some of these devices.

Merge remote-tracking branches 'asoc/fix/davinci', 'asoc/fix/es8328', 'asoc/fix/fsl-sai', 'asoc/fix/rockchip', 'asoc/fix/sgtl5000' and 'asoc/fix/wm8974' into asoc-linus

Pull block layer fixes from Jens Axboe:
 "Three small fixes for 4.4 final. Specifically:

   - The segment issue fix from Junichi, where the old IO path does a
     bio limit split before potentially bouncing the pages.  We need to
     do that in the right order, to ensure that limitations are met.

   - A NVMe surprise removal IO hang fix from Keith.

   - A use-after-free in null_blk, introduced by a previous patch in
     this series.  From Mike Krinkin"

* 'for-linus' of git://git.kernel.dk/linux-block:
  null_blk: fix use-after-free error
  block: ensure to split after potentially bouncing a bio
  NVMe: IO ending fixes on surprise removal

Pull nfsd fix from Bruce Fields:
 "Just one fix for a NFSv4 callback bug introduced in 4.4"

* tag 'nfsd-4.4-1' of git://linux-nfs.org/~bfields/linux:
  nfsd: don't hold ls_mutex across a layout recall