Fix some regressions introduced by previous backports

9 files changed, 633 insertions, 0 deletions

diff --git a/patches/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch b/patches/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch
new file mode 100644
index 0000000..f2133d0
--- /dev/null
+++ b/patches/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch
@@ -0,0 +1,48 @@
+From a5527dda344fff0514b7989ef7a755729769daa1 Mon Sep 17 00:00:00 2001
+From: Rainer Weikusat <rweikusat@mobileactivedefense.com>
+Date: Thu, 11 Feb 2016 19:37:27 +0000
+Subject: af_unix: Guard against other == sk in unix_dgram_sendmsg
+
+commit a5527dda344fff0514b7989ef7a755729769daa1 upstream.
+
+The unix_dgram_sendmsg routine use the following test
+
+if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
+
+to determine if sk and other are in an n:1 association (either
+established via connect or by using sendto to send messages to an
+unrelated socket identified by address). This isn't correct as the
+specified address could have been bound to the sending socket itself or
+because this socket could have been connected to itself by the time of
+the unix_peer_get but disconnected before the unix_state_lock(other). In
+both cases, the if-block would be entered despite other == sk which
+might either block the sender unintentionally or lead to trying to unlock
+the same spin lock twice for a non-blocking send. Add a other != sk
+check to guard against this.
+
+Fixes: 7d267278a9ec ("unix: avoid use-after-free in ep_remove_wait_queue")
+Reported-By: Philipp Hahn <pmhahn@pmhahn.de>
+Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>
+Tested-by: Philipp Hahn <pmhahn@pmhahn.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Zefan Li <lizefan@huawei.com>
+---
+ net/unix/af_unix.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1693,7 +1693,12 @@ restart_locked:
+ 			goto out_unlock;
+ 	}
+ 
+-	if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
++	/* other == sk && unix_peer(other) != sk if
++	 * - unix_peer(sk) == NULL, destination address bound to sk
++	 * - unix_peer(sk) == sk by time of get but disconnected before lock
++	 */
++	if (other != sk &&
++	    unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
+ 		if (timeo) {
+ 			timeo = unix_wait_for_peer(other, timeo);
+ 
diff --git a/patches/alsa-tlv-add-declare_tlv_db_range.patch b/patches/alsa-tlv-add-declare_tlv_db_range.patch
new file mode 100644
index 0000000..49db174
--- /dev/null
+++ b/patches/alsa-tlv-add-declare_tlv_db_range.patch
@@ -0,0 +1,31 @@
+From bf1d1c9b6179faa3bc32cee882462bc8eebde25d Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Sun, 20 Nov 2011 17:17:35 +0100
+Subject: ALSA: tlv: add DECLARE_TLV_DB_RANGE()
+
+commit bf1d1c9b6179faa3bc32cee882462bc8eebde25d upstream.
+
+Add a DECLARE_TLV_DB_RANGE() macro so that dB range information
+can be specified without having to count the items manually for
+TLV_DB_RANGE_HEAD().
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Zefan Li <lizefan@huawei.com>
+---
+ include/sound/tlv.h |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/include/sound/tlv.h
++++ b/include/sound/tlv.h
+@@ -71,6 +71,10 @@
+ 
+ /* dB range container */
+ /* Each item is: <min> <max> <TLV> */
++#define TLV_DB_RANGE_ITEM(...) \
++	TLV_ITEM(SNDRV_CTL_TLVT_DB_RANGE, __VA_ARGS__)
++#define DECLARE_TLV_DB_RANGE(name, ...) \
++	unsigned int name[] = { TLV_DB_RANGE_ITEM(__VA_ARGS__) }
+ /* The below assumes that each item TLV is 4 words like DB_SCALE or LINEAR */
+ #define TLV_DB_RANGE_HEAD(num)			\
+ 	SNDRV_CTL_TLVT_DB_RANGE, 6 * (num) * sizeof(unsigned int)
diff --git a/patches/alsa-tlv-compute-tlv_-_item-lengths-automatically.patch b/patches/alsa-tlv-compute-tlv_-_item-lengths-automatically.patch
new file mode 100644
index 0000000..d4b62e4
--- /dev/null
+++ b/patches/alsa-tlv-compute-tlv_-_item-lengths-automatically.patch
@@ -0,0 +1,64 @@
+From b5b9eb546762c4015c67c31364a6ec6f83fd2ada Mon Sep 17 00:00:00 2001
+From: Clemens Ladisch <clemens@ladisch.de>
+Date: Sun, 20 Nov 2011 16:22:24 +0100
+Subject: ALSA: tlv: compute TLV_*_ITEM lengths automatically
+
+commit b5b9eb546762c4015c67c31364a6ec6f83fd2ada upstream.
+
+Add helper macros with a little bit of preprocessor magic to
+automatically compute the length of a TLV item.  This lets us avoid
+having to compute this by hand, and will allow to use items that do
+not use a fixed length.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Zefan Li <lizefan@huawei.com>
+---
+ include/sound/tlv.h |   20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/include/sound/tlv.h
++++ b/include/sound/tlv.h
+@@ -38,21 +38,26 @@
+ #define SNDRV_CTL_TLVT_DB_MINMAX 4	/* dB scale with min/max */
+ #define SNDRV_CTL_TLVT_DB_MINMAX_MUTE 5	/* dB scale with min/max with mute */
+ 
++#define TLV_ITEM(type, ...) \
++	(type), TLV_LENGTH(__VA_ARGS__), __VA_ARGS__
++#define TLV_LENGTH(...) \
++	((unsigned int)sizeof((const unsigned int[]) { __VA_ARGS__ }))
++
+ #define TLV_DB_SCALE_MASK	0xffff
+ #define TLV_DB_SCALE_MUTE	0x10000
+ #define TLV_DB_SCALE_ITEM(min, step, mute)			\
+-	SNDRV_CTL_TLVT_DB_SCALE, 2 * sizeof(unsigned int),	\
+-	(min), ((step) & TLV_DB_SCALE_MASK) | ((mute) ? TLV_DB_SCALE_MUTE : 0)
++	TLV_ITEM(SNDRV_CTL_TLVT_DB_SCALE,			\
++		 (min),					\
++		 ((step) & TLV_DB_SCALE_MASK) |		\
++			((mute) ? TLV_DB_SCALE_MUTE : 0))
+ #define DECLARE_TLV_DB_SCALE(name, min, step, mute) \
+ 	unsigned int name[] = { TLV_DB_SCALE_ITEM(min, step, mute) }
+ 
+ /* dB scale specified with min/max values instead of step */
+ #define TLV_DB_MINMAX_ITEM(min_dB, max_dB)			\
+-	SNDRV_CTL_TLVT_DB_MINMAX, 2 * sizeof(unsigned int),	\
+-	(min_dB), (max_dB)
++	TLV_ITEM(SNDRV_CTL_TLVT_DB_MINMAX, (min_dB), (max_dB))
+ #define TLV_DB_MINMAX_MUTE_ITEM(min_dB, max_dB)			\
+-	SNDRV_CTL_TLVT_DB_MINMAX_MUTE, 2 * sizeof(unsigned int),	\
+-	(min_dB), (max_dB)
++	TLV_ITEM(SNDRV_CTL_TLVT_DB_MINMAX_MUTE, (min_dB), (max_dB))
+ #define DECLARE_TLV_DB_MINMAX(name, min_dB, max_dB) \
+ 	unsigned int name[] = { TLV_DB_MINMAX_ITEM(min_dB, max_dB) }
+ #define DECLARE_TLV_DB_MINMAX_MUTE(name, min_dB, max_dB) \
+@@ -60,8 +65,7 @@
+ 
+ /* linear volume between min_dB and max_dB (.01dB unit) */
+ #define TLV_DB_LINEAR_ITEM(min_dB, max_dB)		    \
+-	SNDRV_CTL_TLVT_DB_LINEAR, 2 * sizeof(unsigned int), \
+-	(min_dB), (max_dB)
++	TLV_ITEM(SNDRV_CTL_TLVT_DB_LINEAR, (min_dB), (max_dB))
+ #define DECLARE_TLV_DB_LINEAR(name, min_dB, max_dB)	\
+ 	unsigned int name[] = { TLV_DB_LINEAR_ITEM(min_dB, max_dB) }
+ 
diff --git a/patches/alsa-usb-audio-add-a-more-accurate-volume-quirk-for-audioquest-dragonfly.patch b/patches/alsa-usb-audio-add-a-more-accurate-volume-quirk-for-audioquest-dragonfly.patch
new file mode 100644
index 0000000..ff36ec7
--- /dev/null
+++ b/patches/alsa-usb-audio-add-a-more-accurate-volume-quirk-for-audioquest-dragonfly.patch
@@ -0,0 +1,145 @@
+From 42e3121d90f42e57f6dbd6083dff2f57b3ec7daa Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@iki.fi>
+Date: Sun, 13 Dec 2015 20:49:58 +0200
+Subject: ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest
+ DragonFly
+
+commit 42e3121d90f42e57f6dbd6083dff2f57b3ec7daa upstream.
+
+AudioQuest DragonFly DAC reports a volume control range of 0..50
+(0x0000..0x0032) which in USB Audio means a range of 0 .. 0.2dB, which
+is obviously incorrect and would cause software using the dB information
+in e.g. volume sliders to have a massive volume difference in 100..102%
+range.
+
+Commit 2d1cb7f658fb ("ALSA: usb-audio: add dB range mapping for some
+devices") added a dB range mapping for it with range 0..50 dB.
+
+However, the actual volume mapping seems to be neither linear volume nor
+linear dB scale, but instead quite close to the cubic mapping e.g.
+alsamixer uses, with a range of approx. -53...0 dB.
+
+Replace the previous quirk with a custom dB mapping based on some basic
+output measurements, using a 10-item range TLV (which will still fit in
+alsa-lib MAX_TLV_RANGE_SIZE).
+
+Tested on AudioQuest DragonFly HW v1.2. The quirk is only applied if the
+range is 0..50, so if this gets fixed/changed in later HW revisions it
+will no longer be applied.
+
+v2: incorporated Takashi Iwai's suggestion for the quirk application
+method
+
+Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+[lizf: Backoported to 3.4: use dev_info() instead of usb_audio_info()]
+Signed-off-by: Zefan Li <lizefan@huawei.com>
+---
+ sound/usb/mixer.c        |    2 ++
+ sound/usb/mixer_maps.c   |   12 ------------
+ sound/usb/mixer_quirks.c |   37 +++++++++++++++++++++++++++++++++++++
+ sound/usb/mixer_quirks.h |    4 ++++
+ 4 files changed, 43 insertions(+), 12 deletions(-)
+
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1211,6 +1211,8 @@ static void build_feature_ctl(struct mix
+ 		break;
+ 	}
+ 
++	snd_usb_mixer_fu_apply_quirk(state->mixer, cval, unitid, kctl);
++
+ 	range = (cval->max - cval->min) / cval->res;
+ 	/* Are there devices with volume range more than 255? I use a bit more
+ 	 * to be sure. 384 is a resolution magic number found on Logitech
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -319,13 +319,6 @@ static struct usbmix_name_map bose_compa
+ 	{ 0 }	/* terminator */
+ };
+ 
+-/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
+-static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
+-static struct usbmix_name_map dragonfly_1_2_map[] = {
+-	{ 7, NULL, .dB = &dragonfly_1_2_dB },
+-	{ 0 }	/* terminator */
+-};
+-
+ /*
+  * Control map entries
+  */
+@@ -413,11 +406,6 @@ static struct usbmix_ctl_map usbmix_ctl_
+ 		.id = USB_ID(0x05a7, 0x1020),
+ 		.map = bose_companion5_map,
+ 	},
+-	{
+-		/* Dragonfly DAC 1.2 */
+-		.id = USB_ID(0x21b4, 0x0081),
+-		.map = dragonfly_1_2_map,
+-	},
+ 	{ 0 } /* terminator */
+ };
+ 
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -34,6 +34,7 @@
+ #include <sound/control.h>
+ #include <sound/hwdep.h>
+ #include <sound/info.h>
++#include <sound/tlv.h>
+ 
+ #include "usbaudio.h"
+ #include "mixer.h"
+@@ -681,4 +682,40 @@ void snd_usb_mixer_rc_memory_change(stru
+ 		break;
+ 	}
+ }
++
++static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
++					 struct snd_kcontrol *kctl)
++{
++	/* Approximation using 10 ranges based on output measurement on hw v1.2.
++	 * This seems close to the cubic mapping e.g. alsamixer uses. */
++	static const DECLARE_TLV_DB_RANGE(scale,
++		 0,  1, TLV_DB_MINMAX_ITEM(-5300, -4970),
++		 2,  5, TLV_DB_MINMAX_ITEM(-4710, -4160),
++		 6,  7, TLV_DB_MINMAX_ITEM(-3884, -3710),
++		 8, 14, TLV_DB_MINMAX_ITEM(-3443, -2560),
++		15, 16, TLV_DB_MINMAX_ITEM(-2475, -2324),
++		17, 19, TLV_DB_MINMAX_ITEM(-2228, -2031),
++		20, 26, TLV_DB_MINMAX_ITEM(-1910, -1393),
++		27, 31, TLV_DB_MINMAX_ITEM(-1322, -1032),
++		32, 40, TLV_DB_MINMAX_ITEM(-968, -490),
++		41, 50, TLV_DB_MINMAX_ITEM(-441, 0),
++	);
++
++	dev_info(&mixer->chip->dev->dev, "applying DragonFly dB scale quirk\n");
++	kctl->tlv.p = scale;
++	kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
++	kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
++}
++
++void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
++				  struct usb_mixer_elem_info *cval, int unitid,
++				  struct snd_kcontrol *kctl)
++{
++	switch (mixer->chip->usb_id) {
++	case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */
++		if (unitid == 7 && cval->min == 0 && cval->max == 50)
++			snd_dragonfly_quirk_db_scale(mixer, kctl);
++		break;
++	}
++}
+ 
+--- a/sound/usb/mixer_quirks.h
++++ b/sound/usb/mixer_quirks.h
+@@ -9,5 +9,9 @@ void snd_emuusb_set_samplerate(struct sn
+ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
+ 				    int unitid);
+ 
++void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
++				  struct usb_mixer_elem_info *cval, int unitid,
++				  struct snd_kcontrol *kctl);
++
+ #endif /* SND_USB_MIXER_QUIRKS_H */
+ 
diff --git a/patches/dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch b/patches/dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch
new file mode 100644
index 0000000..d0ba86d
--- /dev/null
+++ b/patches/dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch
@@ -0,0 +1,73 @@
+From 2871c69e025e8bc507651d5a9cf81a8a7da9d24b Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Wed, 21 Oct 2015 18:36:49 +0100
+Subject: dm btree remove: fix a bug when rebalancing nodes after removal
+
+commit 2871c69e025e8bc507651d5a9cf81a8a7da9d24b upstream.
+
+Commit 4c7e309340ff ("dm btree remove: fix bug in redistribute3") wasn't
+a complete fix for redistribute3().
+
+The redistribute3 function takes 3 btree nodes and shares out the entries
+evenly between them.  If the three nodes in total contained
+(MAX_ENTRIES * 3) - 1 entries between them then this was erroneously getting
+rebalanced as (MAX_ENTRIES - 1) on the left and right, and (MAX_ENTRIES + 1) in
+the center.
+
+Fix this issue by being more careful about calculating the target number
+of entries for the left and right nodes.
+
+Unit tested in userspace using this program:
+https://github.com/jthornber/redistribute3-test/blob/master/redistribute3_t.c
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Zefan Li <lizefan@huawei.com>
+---
+ drivers/md/persistent-data/dm-btree-remove.c |   17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -301,11 +301,16 @@ static void redistribute3(struct dm_btre
+ {
+ 	int s;
+ 	uint32_t max_entries = le32_to_cpu(left->header.max_entries);
+-	unsigned target = (nr_left + nr_center + nr_right) / 3;
+-	BUG_ON(target > max_entries);
++	unsigned total = nr_left + nr_center + nr_right;
++	unsigned target_right = total / 3;
++	unsigned remainder = (target_right * 3) != total;
++	unsigned target_left = target_right + remainder;
++
++	BUG_ON(target_left > max_entries);
++	BUG_ON(target_right > max_entries);
+ 
+ 	if (nr_left < nr_right) {
+-		s = nr_left - target;
++		s = nr_left - target_left;
+ 
+ 		if (s < 0 && nr_center < -s) {
+ 			/* not enough in central node */
+@@ -316,10 +321,10 @@ static void redistribute3(struct dm_btre
+ 		} else
+ 			shift(left, center, s);
+ 
+-		shift(center, right, target - nr_right);
++		shift(center, right, target_right - nr_right);
+ 
+ 	} else {
+-		s = target - nr_right;
++		s = target_right - nr_right;
+ 		if (s > 0 && nr_center < s) {
+ 			/* not enough in central node */
+ 			shift(center, right, nr_center);
+@@ -329,7 +334,7 @@ static void redistribute3(struct dm_btre
+ 		} else
+ 			shift(center, right, s);
+ 
+-		shift(left, center, nr_left - target);
++		shift(left, center, nr_left - target_left);
+ 	}
+ 
+ 	*key_ptr(parent, c->index) = center->keys[0];
diff --git a/patches/net-fix-warnings-in-make-htmldocs-by-moving-macro-definition-out-of-field-declaration.patch b/patches/net-fix-warnings-in-make-htmldocs-by-moving-macro-definition-out-of-field-declaration.patch
new file mode 100644
index 0000000..fbd1879
--- /dev/null
+++ b/patches/net-fix-warnings-in-make-htmldocs-by-moving-macro-definition-out-of-field-declaration.patch
@@ -0,0 +1,33 @@
+From 7bbadd2d1009575dad675afc16650ebb5aa10612 Mon Sep 17 00:00:00 2001
+From: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Date: Mon, 14 Dec 2015 23:30:43 +0100
+Subject: net: fix warnings in 'make htmldocs' by moving macro definition out
+ of field declaration
+
+commit 7bbadd2d1009575dad675afc16650ebb5aa10612 upstream.
+
+Docbook does not like the definition of macros inside a field declaration
+and adds a warning. Move the definition out.
+
+Fixes: 79462ad02e86180 ("net: add validation for the socket syscall protocol argument")
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+[lizf: Backported to 3.4: adjust context]
+Signed-off-by: Zefan Li <lizefan@huawei.com>
+---
+ include/net/sock.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -328,8 +328,8 @@ struct sock {
+ 				sk_no_check  : 2,
+ 				sk_userlocks : 4,
+ 				sk_protocol  : 8,
+-#define SK_PROTOCOL_MAX ((u8)~0U)
+ 				sk_type      : 16;
++#define SK_PROTOCOL_MAX ((u8)~0U)
+ 	kmemcheck_bitfield_end(flags);
+ 	int			sk_wmem_queued;
+ 	gfp_t			sk_allocation;
diff --git a/patches/series b/patches/series
index 9cf4095..ec49169 100644
--- a/patches/series
+++ b/patches/series
@@ -96,3 +96,11 @@ atm-deal-with-setting-entry-before-mkip-was-called.patch
 sunrpc-never-enqueue-a-rq_cong-request-on-sending.patch
 ipv6-prevent-fib6_run_gc-contention.patch
 kernel-watchdog.c-touch_nmi_watchdog-should-only-touch-local-cpu-not-every-one.patch
+net-fix-warnings-in-make-htmldocs-by-moving-macro-definition-out-of-field-declaration.patch
+af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch
+x86-ldt-print-the-real-ldt-base-address.patch
+alsa-tlv-compute-tlv_-_item-lengths-automatically.patch
+alsa-tlv-add-declare_tlv_db_range.patch
+alsa-usb-audio-add-a-more-accurate-volume-quirk-for-audioquest-dragonfly.patch
+usb-dwc3-fix-assignment-of-ep-transfer-resources.patch
+dm-btree-remove-fix-a-bug-when-rebalancing-nodes-after-removal.patch
diff --git a/patches/usb-dwc3-fix-assignment-of-ep-transfer-resources.patch b/patches/usb-dwc3-fix-assignment-of-ep-transfer-resources.patch
new file mode 100644
index 0000000..d394147
--- /dev/null
+++ b/patches/usb-dwc3-fix-assignment-of-ep-transfer-resources.patch
@@ -0,0 +1,199 @@
+From c450960187f45d4260db87c7dd4fc0bceb5565d8 Mon Sep 17 00:00:00 2001
+From: John Youn <John.Youn@synopsys.com>
+Date: Tue, 16 Feb 2016 20:10:53 -0800
+Subject: usb: dwc3: Fix assignment of EP transfer resources
+
+commit c450960187f45d4260db87c7dd4fc0bceb5565d8 upstream.
+
+The assignement of EP transfer resources was not handled properly in the
+dwc3 driver. Commit aebda6187181 ("usb: dwc3: Reset the transfer
+resource index on SET_INTERFACE") previously fixed one aspect of this
+where resources may be exhausted with multiple calls to SET_INTERFACE.
+However, it introduced an issue where composite devices with multiple
+interfaces can be assigned the same transfer resources for different
+endpoints. This patch solves both issues.
+
+The assignment of transfer resources cannot perfectly follow the data
+book due to the fact that the controller driver does not have all
+knowledge of the configuration in advance. It is given this information
+piecemeal by the composite gadget framework after every
+SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook
+programming model in this scenario can cause errors. For two reasons:
+
+1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION and
+SET_INTERFACE (8.1.5). This is incorrect in the scenario of multiple
+interfaces.
+
+2) The databook does not mention doing more DEPXFERCFG for new endpoint
+on alt setting (8.1.6).
+
+The following simplified method is used instead:
+
+All hardware endpoints can be assigned a transfer resource and this
+setting will stay persistent until either a core reset or hibernation.
+So whenever we do a DEPSTARTCFG(0) we can go ahead and do DEPXFERCFG for
+every hardware endpoint as well. We are guaranteed that there are as
+many transfer resources as endpoints.
+
+This patch triggers off of the calling dwc3_gadget_start_config() for
+EP0-out, which always happens first, and which should only happen in one
+of the above conditions.
+
+Fixes: aebda6187181 ("usb: dwc3: Reset the transfer resource index on SET_INTERFACE")
+Reported-by: Ravi Babu <ravibabu@ti.com>
+Signed-off-by: John Youn <johnyoun@synopsys.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+[lizf: Backported to 3.4: adjust context]
+Signed-off-by: Zefan Li <lizefan@huawei.com>
+---
+ drivers/usb/dwc3/core.h   |    1 
+ drivers/usb/dwc3/ep0.c    |    5 ---
+ drivers/usb/dwc3/gadget.c |   70 ++++++++++++++++++++++++++++++++++------------
+ 3 files changed, 52 insertions(+), 24 deletions(-)
+
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -614,7 +614,6 @@ struct dwc3 {
+ 	unsigned		three_stage_setup:1;
+ 	unsigned		ep0_bounced:1;
+ 	unsigned		ep0_expect_in:1;
+-	unsigned		start_config_issued:1;
+ 	unsigned		setup_packet_pending:1;
+ 	unsigned		delayed_status:1;
+ 	unsigned		needs_fifo_resize:1;
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -442,7 +442,6 @@ static int dwc3_ep0_set_config(struct dw
+ 	u32 cfg;
+ 	int ret;
+ 
+-	dwc->start_config_issued = false;
+ 	cfg = le16_to_cpu(ctrl->wValue);
+ 
+ 	switch (dwc->dev_state) {
+@@ -496,10 +495,6 @@ static int dwc3_ep0_std_request(struct d
+ 		dev_vdbg(dwc->dev, "USB_REQ_SET_CONFIGURATION\n");
+ 		ret = dwc3_ep0_set_config(dwc, ctrl);
+ 		break;
+-	case USB_REQ_SET_INTERFACE:
+-		dev_vdbg(dwc->dev ,"USB_REQ_SET_INTERFACE");
+-		dwc->start_config_issued = false;
+-		/* Fall through */
+ 	default:
+ 		dev_vdbg(dwc->dev, "Forwarding to gadget driver\n");
+ 		ret = dwc3_ep0_delegate_req(dwc, ctrl);
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -359,24 +359,66 @@ static void dwc3_free_trb_pool(struct dw
+ 	dep->trb_pool_dma = 0;
+ }
+ 
++static int dwc3_gadget_set_xfer_resource(struct dwc3 *dwc, struct dwc3_ep *dep);
++
++/**
++ * dwc3_gadget_start_config - Configure EP resources
++ * @dwc: pointer to our controller context structure
++ * @dep: endpoint that is being enabled
++ *
++ * The assignment of transfer resources cannot perfectly follow the
++ * data book due to the fact that the controller driver does not have
++ * all knowledge of the configuration in advance. It is given this
++ * information piecemeal by the composite gadget framework after every
++ * SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook
++ * programming model in this scenario can cause errors. For two
++ * reasons:
++ *
++ * 1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION
++ * and SET_INTERFACE (8.1.5). This is incorrect in the scenario of
++ * multiple interfaces.
++ *
++ * 2) The databook does not mention doing more DEPXFERCFG for new
++ * endpoint on alt setting (8.1.6).
++ *
++ * The following simplified method is used instead:
++ *
++ * All hardware endpoints can be assigned a transfer resource and this
++ * setting will stay persistent until either a core reset or
++ * hibernation. So whenever we do a DEPSTARTCFG(0) we can go ahead and
++ * do DEPXFERCFG for every hardware endpoint as well. We are
++ * guaranteed that there are as many transfer resources as endpoints.
++ *
++ * This function is called for each endpoint when it is being enabled
++ * but is triggered only when called for EP0-out, which always happens
++ * first, and which should only happen in one of the above conditions.
++ */
+ static int dwc3_gadget_start_config(struct dwc3 *dwc, struct dwc3_ep *dep)
+ {
+ 	struct dwc3_gadget_ep_cmd_params params;
+ 	u32			cmd;
++	int			i;
++	int			ret;
++
++	if (dep->number)
++		return 0;
+ 
+ 	memset(&params, 0x00, sizeof(params));
++	cmd = DWC3_DEPCMD_DEPSTARTCFG;
+ 
+-	if (dep->number != 1) {
+-		cmd = DWC3_DEPCMD_DEPSTARTCFG;
+-		/* XferRscIdx == 0 for ep0 and 2 for the remaining */
+-		if (dep->number > 1) {
+-			if (dwc->start_config_issued)
+-				return 0;
+-			dwc->start_config_issued = true;
+-			cmd |= DWC3_DEPCMD_PARAM(2);
+-		}
++	ret = dwc3_send_gadget_ep_cmd(dwc, 0, cmd, &params);
++	if (ret)
++		return ret;
+ 
+-		return dwc3_send_gadget_ep_cmd(dwc, 0, cmd, &params);
++	for (i = 0; i < DWC3_ENDPOINTS_NUM; i++) {
++		struct dwc3_ep *dep = dwc->eps[i];
++
++		if (!dep)
++			continue;
++
++		ret = dwc3_gadget_set_xfer_resource(dwc, dep);
++		if (ret)
++			return ret;
+ 	}
+ 
+ 	return 0;
+@@ -471,10 +513,6 @@ static int __dwc3_gadget_ep_enable(struc
+ 		struct dwc3_trb	*trb_st_hw;
+ 		struct dwc3_trb	*trb_link;
+ 
+-		ret = dwc3_gadget_set_xfer_resource(dwc, dep);
+-		if (ret)
+-			return ret;
+-
+ 		dep->desc = desc;
+ 		dep->comp_desc = comp_desc;
+ 		dep->type = usb_endpoint_type(desc);
+@@ -1375,8 +1413,6 @@ static int dwc3_gadget_start(struct usb_
+ 	reg |= dwc->maximum_speed;
+ 	dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+ 
+-	dwc->start_config_issued = false;
+-
+ 	/* Start with SuperSpeed Default */
+ 	dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(512);
+ 
+@@ -1861,7 +1897,6 @@ static void dwc3_gadget_disconnect_inter
+ 
+ 	dwc3_stop_active_transfers(dwc);
+ 	dwc3_disconnect_gadget(dwc);
+-	dwc->start_config_issued = false;
+ 
+ 	dwc->gadget.speed = USB_SPEED_UNKNOWN;
+ 	dwc->setup_packet_pending = false;
+@@ -1949,7 +1984,6 @@ static void dwc3_gadget_reset_interrupt(
+ 
+ 	dwc3_stop_active_transfers(dwc);
+ 	dwc3_clear_stall_all_ep(dwc);
+-	dwc->start_config_issued = false;
+ 
+ 	/* Reset device address to zero */
+ 	reg = dwc3_readl(dwc->regs, DWC3_DCFG);
diff --git a/patches/x86-ldt-print-the-real-ldt-base-address.patch b/patches/x86-ldt-print-the-real-ldt-base-address.patch
new file mode 100644
index 0000000..f48e95d
--- /dev/null
+++ b/patches/x86-ldt-print-the-real-ldt-base-address.patch
@@ -0,0 +1,32 @@
+From 0d430e3fb3f7cdc13c0d22078b820f682821b45a Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@suse.com>
+Date: Tue, 22 Dec 2015 08:42:44 -0700
+Subject: x86/LDT: Print the real LDT base address
+
+commit 0d430e3fb3f7cdc13c0d22078b820f682821b45a upstream.
+
+This was meant to print base address and entry count; make it do so
+again.
+
+Fixes: 37868fe113ff "x86/ldt: Make modify_ldt synchronous"
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Andy Lutomirski <luto@kernel.org>
+Link: http://lkml.kernel.org/r/56797D8402000078000C24F0@prv-mh.provo.novell.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+[lizf: Backported to 3.4: adjust context]
+Signed-off-by: Zefan Li <lizefan@huawei.com>
+---
+ arch/x86/kernel/process_64.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -119,7 +119,7 @@ void release_thread(struct task_struct *
+ 		if (dead_task->mm->context.ldt) {
+ 			printk("WARNING: dead process %8s still has LDT? <%p/%d>\n",
+ 					dead_task->comm,
+-					dead_task->mm->context.ldt,
++					dead_task->mm->context.ldt->entries,
+ 					dead_task->mm->context.ldt->size);
+ 			BUG();
+ 		}