commit 6c789d9eddab3bff59e89aa6f2723b1ff652fed9
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sun Oct 16 17:48:03 2016 +0200

    Linux 4.4.25

commit 8866a28836924a0bfa84f1cbf574eb5138b7dec4
Author: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Date:   Fri Sep 2 22:34:17 2016 +0300

    tpm_crb: fix crb_req_canceled behavior
    
    commit 72fd50e14e46dc0edf360631bdece87c2f066a97 upstream.
    
    The req_canceled() callback is used by tpm_transmit() periodically to
    check whether the request has been canceled while it is receiving a
    response from the TPM.
    
    The TPM_CRB_CTRL_CANCEL register was cleared already in the crb_cancel
    callback, which has two consequences:
    
    * Cancel might not happen.
    * req_canceled() always returns zero.
    
    A better place to clear the register is when starting to send a new
    command. The behavior of TPM_CRB_CTRL_CANCEL is described in the
    section 5.5.3.6 of the PTP specification.
    
    Fixes: 30fc8d138e91 ("tpm: TPM 2.0 CRB Interface")
    Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c0201ae6796a830fa7eb0cb537239102bedcbcc5
Author: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Date:   Tue Aug 16 22:00:38 2016 +0300

    tpm: fix a race condition in tpm2_unseal_trusted()
    
    commit d4816edfe706497a8525480c1685ceb9871bc118 upstream.
    
    Unseal and load operations should be done as an atomic operation. This
    commit introduces unlocked tpm_transmit() so that tpm2_unseal_trusted()
    can do the locking by itself.
    
    Fixes: 0fe5480303a1 ("keys, trusted: seal/unseal with TPM 2.0 chips")
    Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0040b7466cbd6d7a7f84d0eed86e328da21c0e27
Author: Miklos Szeredi <mszeredi@redhat.com>
Date:   Fri Sep 16 12:44:20 2016 +0200

    ima: use file_dentry()
    
    commit e71b9dff0634edb127f449e076e883ef24a8c76c upstream.
    
    Ima tries to call ->setxattr() on overlayfs dentry after having locked
    underlying inode, which results in a deadlock.
    
    Reported-by: Krisztian Litkey <kli@iki.fi>
    Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
    Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5769cba883d655555e951fa5b7321e7604b78384
Author: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
Date:   Thu Aug 11 15:02:30 2016 +0200

    ARM: cpuidle: Fix error return code
    
    commit af48d7bc3756a0cd882d65bff14ab39746ba57fe upstream.
    
    We know that 'ret = 0' because it has been tested a few lines above.
    So, if 'kzalloc' fails, 0 will be returned instead of an error code.
    Return -ENOMEM instead.
    
    Fixes: a0d46a3dfdc3 ("ARM: cpuidle: Register per cpuidle device")
    Signed-off-by: Christophe Jaillet <christophe.jaillet@wanadoo.fr>
    Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 847547dd82519ac38c632f035f0420a7948319da
Author: Linus Walleij <linus.walleij@linaro.org>
Date:   Fri Aug 5 10:38:37 2016 +0200

    ARM: dts: MSM8064 remove flags from SPMI/MPP IRQs
    
    commit ca88696e8b73a9fa2b1de445747e9235c3a7bd50 upstream.
    
    The Qualcomm PMIC GPIO and MPP lines are problematic: the
    are fetched from the main MFD driver with platform_get_irq()
    which means that at this point they will all be assigned the
    flags set up for the interrupts in the device tree.
    
    That is problematic since these are flagged as rising edge
    and an this point the interrupt descriptor is assigned a
    rising edge, while the only thing the GPIO/MPP drivers really
    do is issue irq_get_irqchip_state() on the line to read it
    out and to provide a .to_irq() helper for *other* IRQ
    consumers.
    
    If another device tree node tries to flag the same IRQ
    for use as something else than rising edge, the kernel
    irqdomain core will protest like this:
    
      type mismatch, failed to map hwirq-NN for <FOO>!
    
    Which is what happens when the device tree defines two
    contradictory flags for the same interrupt line.
    
    To work around this and alleviate the problem, assign 0
    as flag for the interrupts taken by the PM GPIO and MPP
    drivers. This will lead to the flag being unset, and a
    second consumer requesting rising, falling, both or level
    interrupts will be respected. This is what the qcom-pm*.dtsi
    files already do.
    
    Switched to using the symbolic name IRQ_TYPE_NONE so that
    we get this more readable.
    
    Fixes: bce360469676 ("ARM: dts: apq8064: add pm8921 mpp support")
    Fixes: 874443fe9e33 ("ARM: dts: apq8064: Add pm8921 mfd and its gpio node")
    Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
    Cc: Stephen Boyd <sboyd@codeaurora.org>
    Cc: Björn Andersson <bjorn.andersson@linaro.org>
    Cc: Ivan T. Ivanov <ivan.ivanov@linaro.org>
    Cc: John Stultz <john.stultz@linaro.org>
    Cc: Andy Gross <andy.gross@linaro.org>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Andy Gross <andy.gross@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7d19a914dcb6a25861173473f312fb52c546eea7
Author: Grzegorz Jaszczyk <jaz@semihalf.com>
Date:   Thu Aug 4 12:14:08 2016 +0200

    ARM: dts: mvebu: armada-390: add missing compatibility string and bracket
    
    commit 061492cfad9f11dbc32df741a7164f307b69b6e6 upstream.
    
    The armada-390.dtsi was broken since the first patch which adds Device Tree
    files for Armada 39x SoC was introduced.
    
    Signed-off-by: Grzegorz Jaszczyk <jaz@semihalf.com>
    Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
    Fixes 538da83 ("ARM: mvebu: add Device Tree files for Armada 39x SoC and board")
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    
    Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>

commit 63f9190b09dd9980e50ea01c81eb5a06b798d9e2
Author: Josh Poimboeuf <jpoimboe@redhat.com>
Date:   Thu Aug 18 10:59:06 2016 -0500

    x86/dumpstack: Fix x86_32 kernel_stack_pointer() previous stack access
    
    commit 72b4f6a5e903b071f2a7c4eb1418cbe4eefdc344 upstream.
    
    On x86_32, when an interrupt happens from kernel space, SS and SP aren't
    pushed and the existing stack is used.  So pt_regs is effectively two
    words shorter, and the previous stack pointer is normally the memory
    after the shortened pt_regs, aka '&regs->sp'.
    
    But in the rare case where the interrupt hits right after the stack
    pointer has been changed to point to an empty stack, like for example
    when call_on_stack() is used, the address immediately after the
    shortened pt_regs is no longer on the stack.  In that case, instead of
    '&regs->sp', the previous stack pointer should be retrieved from the
    beginning of the current stack page.
    
    kernel_stack_pointer() wants to do that, but it forgets to dereference
    the pointer.  So instead of returning a pointer to the previous stack,
    it returns a pointer to the beginning of the current stack.
    
    Note that it's probably outside of kernel_stack_pointer()'s scope to be
    switching stacks at all.  The x86_64 version of this function doesn't do
    it, and it would be better for the caller to do it if necessary.  But
    that's a patch for another day.  This just fixes the original intent.
    
    Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Brian Gerst <brgerst@gmail.com>
    Cc: Byungchul Park <byungchul.park@lge.com>
    Cc: Denys Vlasenko <dvlasenk@redhat.com>
    Cc: Frederic Weisbecker <fweisbec@gmail.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Nilay Vaish <nilayvaish@gmail.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Fixes: 0788aa6a23cb ("x86: Prepare removal of previous_esp from i386 thread_info structure")
    Link: http://lkml.kernel.org/r/472453d6e9f6a2d4ab16aaed4935f43117111566.1471535549.git.jpoimboe@redhat.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eba90a4c76b91db06c307035c06b20dbcb5fa487
Author: Mika Westerberg <mika.westerberg@linux.intel.com>
Date:   Mon Oct 3 13:17:08 2016 +0300

    x86/irq: Prevent force migration of irqs which are not in the vector domain
    
    commit db91aa793ff984ac048e199ea1c54202543952fe upstream.
    
    When a CPU is about to be offlined we call fixup_irqs() that resets IRQ
    affinities related to the CPU in question. The same thing is also done when
    the system is suspended to S-states like S3 (mem).
    
    For each IRQ we try to complete any on-going move regardless whether the
    IRQ is actually part of x86_vector_domain. For each IRQ descriptor we fetch
    its chip_data, assume it is of type struct apic_chip_data and manipulate it
    by clearing old_domain mask etc. For irq_chips that are not part of the
    x86_vector_domain, like those created by various GPIO drivers, will find
    their chip_data being changed unexpectly.
    
    Below is an example where GPIO chip owned by pinctrl-sunrisepoint.c gets
    corrupted after resume:
    
      # cat /sys/kernel/debug/gpio
      gpiochip0: GPIOs 360-511, parent: platform/INT344B:00, INT344B:00:
       gpio-511 (                    |sysfs               ) in  hi
    
      # rtcwake -s10 -mmem
      <10 seconds passes>
    
      # cat /sys/kernel/debug/gpio
      gpiochip0: GPIOs 360-511, parent: platform/INT344B:00, INT344B:00:
       gpio-511 (                    |sysfs               ) in  ?
    
    Note '?' in the output. It means the struct gpio_chip ->get function is
    NULL whereas before suspend it was there.
    
    Fix this by first checking that the IRQ belongs to x86_vector_domain before
    we try to use the chip_data as struct apic_chip_data.
    
    Reported-and-tested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
    Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
    Link: http://lkml.kernel.org/r/20161003101708.34795-1-mika.westerberg@linux.intel.com
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 09634475c76af9841dbd209f66cc34cc50877176
Author: Dan Williams <dan.j.williams@intel.com>
Date:   Wed Sep 21 12:50:45 2016 -0700

    x86/boot: Fix kdump, cleanup aborted E820_PRAM max_pfn manipulation
    
    commit 917db484dc6a69969d317b3e57add4208a8d9d42 upstream.
    
    In commit:
    
      ec776ef6bbe1 ("x86/mm: Add support for the non-standard protected e820 type")
    
    Christoph references the original patch I wrote implementing pmem support.
    The intent of the 'max_pfn' changes in that commit were to enable persistent
    memory ranges to be covered by the struct page memmap by default.
    
    However, that approach was abandoned when Christoph ported the patches [1], and
    that functionality has since been replaced by devm_memremap_pages().
    
    In the meantime, this max_pfn manipulation is confusing kdump [2] that
    assumes that everything covered by the max_pfn is "System RAM".  This
    results in kdump hanging or crashing.
    
     [1]: https://lists.01.org/pipermail/linux-nvdimm/2015-March/000348.html
     [2]: https://bugzilla.redhat.com/show_bug.cgi?id=1351098
    
    So fix it.
    
    Reported-by: Zhang Yi <yizhan@redhat.com>
    Reported-by: Jeff Moyer <jmoyer@redhat.com>
    Tested-by: Zhang Yi <yizhan@redhat.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Boaz Harrosh <boaz@plexistor.com>
    Cc: Christoph Hellwig <hch@lst.de>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Ross Zwisler <ross.zwisler@linux.intel.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: linux-nvdimm@lists.01.org
    Fixes: ec776ef6bbe1 ("x86/mm: Add support for the non-standard protected e820 type")
    Link: http://lkml.kernel.org/r/147448744538.34910.11287693517367139607.stgit@dwillia2-desk3.amr.corp.intel.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit eb825842eb01ac84cdb9dba71195752bf2094345
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Thu Jul 14 13:15:46 2016 +0300

    KVM: PPC: BookE: Fix a sanity check
    
    commit ac0e89bb4744d3882ccd275f2416d9ce22f4e1e7 upstream.
    
    We use logical negate where bitwise negate was intended.  It means that
    we never return -EINVAL here.
    
    Fixes: ce11e48b7fdd ('KVM: PPC: E500: Add userspace debug stub support')
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Alexander Graf <agraf@suse.de>
    Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d450527ad04ad180636679aeb3161ec58079f1ba
Author: James Hogan <james.hogan@imgtec.com>
Date:   Thu Sep 15 17:20:06 2016 +0100

    KVM: MIPS: Drop other CPU ASIDs on guest MMU changes
    
    commit 91e4f1b6073dd680d86cdb7e42d7cccca9db39d8 upstream.
    
    When a guest TLB entry is replaced by TLBWI or TLBWR, we only invalidate
    TLB entries on the local CPU. This doesn't work correctly on an SMP host
    when the guest is migrated to a different physical CPU, as it could pick
    up stale TLB mappings from the last time the vCPU ran on that physical
    CPU.
    
    Therefore invalidate both user and kernel host ASIDs on other CPUs,
    which will cause new ASIDs to be generated when it next runs on those
    CPUs.
    
    We're careful only to do this if the TLB entry was already valid, and
    only for the kernel ASID where the virtual address it mapped is outside
    of the guest user address range.
    
    Signed-off-by: James Hogan <james.hogan@imgtec.com>
    Cc: Paolo Bonzini <pbonzini@redhat.com>
    Cc: "Radim Krčmář" <rkrcmar@redhat.com>
    Cc: Ralf Baechle <ralf@linux-mips.org>
    Cc: linux-mips@linux-mips.org
    Cc: kvm@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 418fdccd410e34e358368b5439a20dd08d75c3c2
Author: Thomas Huth <thuth@redhat.com>
Date:   Wed Sep 21 15:06:45 2016 +0200

    KVM: PPC: Book3s PR: Allow access to unprivileged MMCR2 register
    
    commit fa73c3b25bd8d0d393dc6109a1dba3c2aef0451e upstream.
    
    The MMCR2 register is available twice, one time with number 785
    (privileged access), and one time with number 769 (unprivileged,
    but it can be disabled completely). In former times, the Linux
    kernel was using the unprivileged register 769 only, but since
    commit 8dd75ccb571f3c92c ("powerpc: Use privileged SPR number
    for MMCR2"), it uses the privileged register 785 instead.
    The KVM-PR code then of course also switched to use the SPR 785,
    but this is causing older guest kernels to crash, since these
    kernels still access 769 instead. So to support older kernels
    with KVM-PR again, we have to support register 769 in KVM-PR, too.
    
    Fixes: 8dd75ccb571f3c92c48014b3dabd3d51a115ab41
    Signed-off-by: Thomas Huth <thuth@redhat.com>
    Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5a4a45686a87f29aadf462c605df5f9361b56310
Author: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Date:   Fri Jul 29 21:29:15 2016 +0200

    mfd: wm8350-i2c: Make sure the i2c regmap functions are compiled
    
    commit 88003fb10f1fc606e1704611c62ceae95fd1d7da upstream.
    
    This fixes a compile failure:
    
            drivers/built-in.o: In function `wm8350_i2c_probe':
            core.c:(.text+0x828b0): undefined reference to `__devm_regmap_init_i2c'
            Makefile:953: recipe for target 'vmlinux' failed
    
    Fixes: 52b461b86a9f ("mfd: Add regmap cache support for wm8350")
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 0114e3e52730b76e0976a43ef496d4925eda1893
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Thu Aug 4 08:26:56 2016 +0300

    mfd: 88pm80x: Double shifting bug in suspend/resume
    
    commit 9a6dc644512fd083400a96ac4a035ac154fe6b8d upstream.
    
    set_bit() and clear_bit() take the bit number so this code is really
    doing "1 << (1 << irq)" which is a double shift bug.  It's done
    consistently so it won't cause a problem unless "irq" is more than 4.
    
    Fixes: 70c6cce04066 ('mfd: Support 88pm80x in 80x driver')
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5303b53ef3b0bf7953f503558e9354ed185374eb
Author: Boris Brezillon <boris.brezillon@free-electrons.com>
Date:   Tue Sep 6 14:19:29 2016 +0200

    mfd: atmel-hlcdc: Do not sleep in atomic context
    
    commit 2c2469bc03d569c49119db2cccb5cb3f0c6a5b33 upstream.
    
    readl_poll_timeout() calls usleep_range(), but
    regmap_atmel_hlcdc_reg_write() is called in atomic context (regmap
    spinlock held).
    
    Replace the readl_poll_timeout() call by readl_poll_timeout_atomic().
    
    Fixes: ea31c0cf9b07 ("mfd: atmel-hlcdc: Implement config synchronization")
    Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9de8720a92b7189efb6f10655e6c09d0a931875f
Author: Lu Baolu <baolu.lu@linux.intel.com>
Date:   Thu Aug 11 10:39:03 2016 +0800

    mfd: rtsx_usb: Avoid setting ucr->current_sg.status
    
    commit 8dcc5ff8fcaf778bb57ab4448fedca9e381d088f upstream.
    
    Member "status" of struct usb_sg_request is managed by usb core. A
    spin lock is used to serialize the change of it. The driver could
    check the value of req->status, but should avoid changing it without
    the hold of the spinlock. Otherwise, it could cause race or error
    in usb core.
    
    This patch could be backported to stable kernels with version later
    than v3.14.
    
    Cc: Alan Stern <stern@rowland.harvard.edu>
    Cc: Roger Tseng <rogerable@realtek.com>
    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a2afa5f1a3c9b1226451ae05440a2dd344cf34f8
Author: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Date:   Sun Sep 25 22:00:20 2016 +0900

    ALSA: usb-line6: use the same declaration as definition in header for MIDI manufacturer ID
    
    commit 8da08ca03b73593d5299893bf29fc08569c3fb5f upstream.
    
    Currently, usb-line6 module exports an array of MIDI manufacturer ID and
    usb-pod module uses it. However, the declaration is not the definition in
    common header. The difference is explicit length of array. Although
    compiler calculates it and everything goes well, it's better to use the
    same representation between definition and declaration.
    
    This commit fills the length of array for usb-line6 module. As a small
    good sub-effect, this commit suppress below warnings from static analysis
    by sparse v0.5.0.
    
    sound/usb/line6/driver.c:274:43: error: cannot size expression
    sound/usb/line6/driver.c:275:16: error: cannot size expression
    sound/usb/line6/driver.c:276:16: error: cannot size expression
    sound/usb/line6/driver.c:277:16: error: cannot size expression
    
    Fixes: 705ececd1c60 ("Staging: add line6 usb driver")
    Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c143a28cb65cfd43219327a5bc2bed083cd972eb
Author: Anssi Hannula <anssi.hannula@iki.fi>
Date:   Fri Sep 23 06:43:47 2016 +0300

    ALSA: usb-audio: Extend DragonFly dB scale quirk to cover other variants
    
    commit eb1a74b7bea17eea31915c4f76385cefe69d9795 upstream.
    
    The DragonFly quirk added in 42e3121d90f4 ("ALSA: usb-audio: Add a more
    accurate volume quirk for AudioQuest DragonFly") applies a custom dB map
    on the volume control when its range is reported as 0..50 (0 .. 0.2dB).
    
    However, there exists at least one other variant (hw v1.0c, as opposed
    to the tested v1.2) which reports a different non-sensical volume range
    (0..53) and the custom map is therefore not applied for that device.
    
    This results in all of the volume change appearing close to 100% on
    mixer UIs that utilize the dB TLV information.
    
    Add a fallback case where no dB TLV is reported at all if the control
    range is not 0..50 but still 0..N where N <= 1000 (3.9 dB). Also
    restrict the quirk to only apply to the volume control as there is also
    a mute control which would match the check otherwise.
    
    Fixes: 42e3121d90f4 ("ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly")
    Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
    Reported-by: David W <regulars@d-dub.org.uk>
    Tested-by: David W <regulars@d-dub.org.uk>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4be05b0a7e03fab078fe31e41d22c9af27d337d8
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Sep 21 14:38:02 2016 +0200

    ALSA: ali5451: Fix out-of-bound position reporting
    
    commit db68577966abc1aeae4ec597b3dcfa0d56e92041 upstream.
    
    The pointer callbacks of ali5451 driver may return the value at the
    boundary occasionally, and it results in the kernel warning like
      snd_ali5451 0000:00:06.0: BUG: , pos = 16384, buffer size = 16384, period size = 1024
    
    It seems that folding the position offset is enough for fixing the
    warning and no ill-effect has been seen by that.
    
    Reported-by: Enrico Mioso <mrkiko.rs@gmail.com>
    Tested-by: Enrico Mioso <mrkiko.rs@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 78c7b55b362e868e529ab6579134708fcf5539dd
Author: John Stultz <john.stultz@linaro.org>
Date:   Tue Oct 4 19:55:48 2016 -0700

    timekeeping: Fix __ktime_get_fast_ns() regression
    
    commit 58bfea9532552d422bde7afa207e1a0f08dffa7d upstream.
    
    In commit 27727df240c7 ("Avoid taking lock in NMI path with
    CONFIG_DEBUG_TIMEKEEPING"), I changed the logic to open-code
    the timekeeping_get_ns() function, but I forgot to include
    the unit conversion from cycles to nanoseconds, breaking the
    function's output, which impacts users like perf.
    
    This results in bogus perf timestamps like:
     swapper     0 [000]   253.427536:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   254.426573:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   254.426687:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   254.426800:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   254.426905:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   254.427022:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   254.427127:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   254.427239:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   254.427346:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   254.427463:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]   255.426572:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
    
    Instead of more reasonable expected timestamps like:
     swapper     0 [000]    39.953768:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    40.064839:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    40.175956:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    40.287103:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    40.398217:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    40.509324:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    40.620437:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    40.731546:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    40.842654:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    40.953772:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
     swapper     0 [000]    41.064881:  111111111 cpu-clock:  ffffffff810a0de6 native_safe_halt+0x6 ([kernel.kallsyms])
    
    Add the proper use of timekeeping_delta_to_ns() to convert
    the cycle delta to nanoseconds as needed.
    
    Thanks to Brendan and Alexei for finding this quickly after
    the v4.8 release. Unfortunately the problematic commit has
    landed in some -stable trees so they'll need this fix as
    well.
    
    Many apologies for this mistake. I'll be looking to add a
    perf-clock sanity test to the kselftest timers tests soon.
    
    Fixes: 27727df240c7 "timekeeping: Avoid taking lock in NMI path with CONFIG_DEBUG_TIMEKEEPING"
    Reported-by: Brendan Gregg <bgregg@netflix.com>
    Reported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
    Tested-and-reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Link: http://lkml.kernel.org/r/1475636148-26539-1-git-send-email-john.stultz@linaro.org
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9b57d91c03054030f30be75c6e19c65b5f108ef3
Author: Christopher S. Hall <christopher.s.hall@intel.com>
Date:   Mon Feb 22 03:15:19 2016 -0800

    time: Add cycles to nanoseconds translation
    
    commit 6bd58f09e1d8cc6c50a824c00bf0d617919986a1 upstream.
    
    The timekeeping code does not currently provide a way to translate
    externally provided clocksource cycles to system time. The cycle count
    is always provided by the result clocksource read() method internal to
    the timekeeping code. The added function timekeeping_cycles_to_ns()
    calculated a nanosecond value from a cycle count that can be added to
    tk_read_base.base value yielding the current system time. This allows
    clocksource cycle values external to the timekeeping code to provide a
    cycle count that can be transformed to system time.
    
    Cc: Prarit Bhargava <prarit@redhat.com>
    Cc: Richard Cochran <richardcochran@gmail.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: kevin.b.stanton@intel.com
    Cc: kevin.j.clarke@intel.com
    Cc: hpa@zytor.com
    Cc: jeffrey.t.kirsher@intel.com
    Cc: netdev@vger.kernel.org
    Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Christopher S. Hall <christopher.s.hall@intel.com>
    Signed-off-by: John Stultz <john.stultz@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>