--- /dev/null
+From c4ad72560df11961d3e57fb0fadfe88a9863c9ad Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Thu, 8 Sep 2016 10:48:38 +0200
+Subject: ARM: dts: fix RealView EB SMSC ethernet version
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit c4ad72560df11961d3e57fb0fadfe88a9863c9ad upstream.
+
+The ethernet version in the earlier RealView EB variants is
+LAN91C111 and not LAN9118 according to ARM DUI 0303E
+"RealView Emulation Baseboard User Guide" page 3-57.
+
+Make sure that this is used for the base variant of the board.
+
+As the DT bindings for LAN91C111 does not specify any power
+supplies, these need to be deleted from the DTS file.
+
+Fixes: 2440d29d2ae2 ("ARM: dts: realview: support all the RealView EB board variants")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/arm-realview-eb.dtsi | 23 +++++++----------------
+ 1 file changed, 7 insertions(+), 16 deletions(-)
+
+--- a/arch/arm/boot/dts/arm-realview-eb.dtsi
++++ b/arch/arm/boot/dts/arm-realview-eb.dtsi
+@@ -51,14 +51,6 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
+- compatible = "regulator-fixed";
+- regulator-name = "veth";
+- regulator-min-microvolt = <3300000>;
+- regulator-max-microvolt = <3300000>;
+- regulator-boot-on;
+- };
+-
+ xtal24mhz: xtal24mhz@24M {
+ #clock-cells = <0>;
+ compatible = "fixed-clock";
+@@ -134,16 +126,15 @@
+ bank-width = <4>;
+ };
+
+- /* SMSC 9118 ethernet with PHY and EEPROM */
++ /* SMSC LAN91C111 ethernet with PHY and EEPROM */
+ ethernet: ethernet@4e000000 {
+- compatible = "smsc,lan9118", "smsc,lan9115";
++ compatible = "smsc,lan91c111";
+ reg = <0x4e000000 0x10000>;
+- phy-mode = "mii";
+- reg-io-width = <4>;
+- smsc,irq-active-high;
+- smsc,irq-push-pull;
+- vdd33a-supply = <&veth>;
+- vddvario-supply = <&veth>;
++ /*
++ * This means the adapter can be accessed with 8, 16 or
++ * 32 bit reads/writes.
++ */
++ reg-io-width = <7>;
+ };
+
+ usb: usb@4f000000 {
--- /dev/null
+From c53beb47f621e4a56f31af9f86470041655516c7 Mon Sep 17 00:00:00 2001
+From: Jon Mason <jon.mason@broadcom.com>
+Date: Thu, 14 Jul 2016 16:14:17 -0400
+Subject: ARM: dts: NSP: Correct RAM amount for BCM958625HR board
+
+From: Jon Mason <jon.mason@broadcom.com>
+
+commit c53beb47f621e4a56f31af9f86470041655516c7 upstream.
+
+The BCM958625HR board has 2GB of RAM available. Increase the amount
+from 512MB to 2GB and add the device type to the memory entry.
+
+Fixes: 9a4865d42fe5 ("ARM: dts: NSP: Specify RAM amount for BCM958625HR board")
+Signed-off-by: Jon Mason <jon.mason@broadcom.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/bcm958625hr.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/bcm958625hr.dts
++++ b/arch/arm/boot/dts/bcm958625hr.dts
+@@ -47,7 +47,8 @@
+ };
+
+ memory {
+- reg = <0x60000000 0x20000000>;
++ device_type = "memory";
++ reg = <0x60000000 0x80000000>;
+ };
+ };
+
--- /dev/null
+From 0b965a13ad81fa895e534d1f50b355ff8b0b3ed3 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Mon, 1 Aug 2016 12:46:56 -0400
+Subject: ARM: dts: omap3: overo: add missing unit name for lcd35 display
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+commit 0b965a13ad81fa895e534d1f50b355ff8b0b3ed3 upstream.
+
+Commit b8d368caa8dc ("ARM: dts: omap3: overo: remove unneded unit names
+in display nodes") removed the unit names for all Overo display nodes
+that didn't have a reg property.
+
+But the display in arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi does
+have a reg property so the correct fix was to make the unit name match
+the value of the reg property, instead of removing it.
+
+This patch fixes the following DTC warning for boards using this dtsi:
+
+"ocp/spi@48098000/display has a reg or ranges property, but no unit name"
+
+Fixes: b8d368caa8dc ("ARM: dts: omap3: overo: remove unneded unit names in display nodes")
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
++++ b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi
+@@ -119,7 +119,7 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&mcspi1_pins>;
+
+- lcd0: display {
++ lcd0: display@1 {
+ compatible = "lgphilips,lb035q02";
+ label = "lcd35";
+
--- /dev/null
+From 06ad11be7a9e13499ff8e55e46f09d22f9ee6fc0 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Sat, 27 Aug 2016 15:59:50 +0800
+Subject: ARM: dts: sun9i: Add missing #interrupt-cells to R_PIO pinctrl device node
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 06ad11be7a9e13499ff8e55e46f09d22f9ee6fc0 upstream.
+
+The R_PIO device node is missing #interrupt-cells, which causes
+interrupt parsing to fail to match it as a valid interrupt controller.
+
+Add #interrupt-cells to it. Also remove the unnecesary #address-cells
+and #size-cells.
+
+Fixes: 1ac56a6da9e1 ("ARM: dts: sun9i: Add A80 R_PIO pin controller device
+ node")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/sun9i-a80.dtsi | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/sun9i-a80.dtsi
++++ b/arch/arm/boot/dts/sun9i-a80.dtsi
+@@ -899,8 +899,7 @@
+ resets = <&apbs_rst 0>;
+ gpio-controller;
+ interrupt-controller;
+- #address-cells = <1>;
+- #size-cells = <0>;
++ #interrupt-cells = <3>;
+ #gpio-cells = <3>;
+
+ r_ir_pins: r_ir {
--- /dev/null
+From ca26475bf02ed8562b9b46f91d3e8b52ec312541 Mon Sep 17 00:00:00 2001
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+Date: Tue, 2 Aug 2016 00:01:32 +0200
+Subject: ARM: pxa: fix GPIO double shifts
+
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+
+commit ca26475bf02ed8562b9b46f91d3e8b52ec312541 upstream.
+
+The commit 9bf448c66d4b ("ARM: pxa: use generic gpio operation instead of
+gpio register") from Oct 17, 2011, leads to the following static checker
+warning:
+ arch/arm/mach-pxa/spitz_pm.c:172 spitz_charger_wakeup()
+ warn: double left shift '!gpio_get_value(SPITZ_GPIO_KEY_INT)
+ << (1 << ((SPITZ_GPIO_KEY_INT) & 31))'
+
+As Dan reported, the value is shifted three times :
+ - once by gpio_get_value(), which returns either 0 or BIT(gpio)
+ - once by the shift operation '<<'
+ - a last time by GPIO_bit(gpio) which is BIT(gpio)
+
+Therefore the calculation lead to a chained or operator of :
+ - (1 << gpio) << (1 << gpio) = (2^gpio)^gpio = 2 ^ (gpio * gpio)
+
+It is be sheer luck the former statement works, only because each gpio
+used is strictly smaller than 6, and therefore 2^(gpio^2) never
+overflows a 32 bits value, and because it is used as a boolean value to
+check a gpio activation.
+
+As the xxx_charger_wakeup() functions are used as a true/false detection
+mechanism, take that opportunity to change their prototypes from integer
+return value to boolean one.
+
+Fixes: 9bf448c66d4b ("ARM: pxa: use generic gpio operation instead of
+gpio register")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Joe Perches <joe@perches.com>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-pxa/corgi_pm.c | 13 ++++---------
+ arch/arm/mach-pxa/sharpsl_pm.c | 2 +-
+ arch/arm/mach-pxa/sharpsl_pm.h | 2 +-
+ arch/arm/mach-pxa/spitz_pm.c | 9 +++------
+ 4 files changed, 9 insertions(+), 17 deletions(-)
+
+--- a/arch/arm/mach-pxa/corgi_pm.c
++++ b/arch/arm/mach-pxa/corgi_pm.c
+@@ -131,16 +131,11 @@ static int corgi_should_wakeup(unsigned
+ return is_resume;
+ }
+
+-static unsigned long corgi_charger_wakeup(void)
++static bool corgi_charger_wakeup(void)
+ {
+- unsigned long ret;
+-
+- ret = (!gpio_get_value(CORGI_GPIO_AC_IN) << GPIO_bit(CORGI_GPIO_AC_IN))
+- | (!gpio_get_value(CORGI_GPIO_KEY_INT)
+- << GPIO_bit(CORGI_GPIO_KEY_INT))
+- | (!gpio_get_value(CORGI_GPIO_WAKEUP)
+- << GPIO_bit(CORGI_GPIO_WAKEUP));
+- return ret;
++ return !gpio_get_value(CORGI_GPIO_AC_IN) ||
++ !gpio_get_value(CORGI_GPIO_KEY_INT) ||
++ !gpio_get_value(CORGI_GPIO_WAKEUP);
+ }
+
+ unsigned long corgipm_read_devdata(int type)
+--- a/arch/arm/mach-pxa/sharpsl_pm.c
++++ b/arch/arm/mach-pxa/sharpsl_pm.c
+@@ -744,7 +744,7 @@ static int sharpsl_off_charge_battery(vo
+ time = RCNR;
+ while (1) {
+ /* Check if any wakeup event had occurred */
+- if (sharpsl_pm.machinfo->charger_wakeup() != 0)
++ if (sharpsl_pm.machinfo->charger_wakeup())
+ return 0;
+ /* Check for timeout */
+ if ((RCNR - time) > SHARPSL_WAIT_CO_TIME)
+--- a/arch/arm/mach-pxa/sharpsl_pm.h
++++ b/arch/arm/mach-pxa/sharpsl_pm.h
+@@ -34,7 +34,7 @@ struct sharpsl_charger_machinfo {
+ #define SHARPSL_STATUS_LOCK 5
+ #define SHARPSL_STATUS_CHRGFULL 6
+ #define SHARPSL_STATUS_FATAL 7
+- unsigned long (*charger_wakeup)(void);
++ bool (*charger_wakeup)(void);
+ int (*should_wakeup)(unsigned int resume_on_alarm);
+ void (*backlight_limit)(int);
+ int (*backlight_get_status) (void);
+--- a/arch/arm/mach-pxa/spitz_pm.c
++++ b/arch/arm/mach-pxa/spitz_pm.c
+@@ -165,13 +165,10 @@ static int spitz_should_wakeup(unsigned
+ return is_resume;
+ }
+
+-static unsigned long spitz_charger_wakeup(void)
++static bool spitz_charger_wakeup(void)
+ {
+- unsigned long ret;
+- ret = ((!gpio_get_value(SPITZ_GPIO_KEY_INT)
+- << GPIO_bit(SPITZ_GPIO_KEY_INT))
+- | gpio_get_value(SPITZ_GPIO_SYNC));
+- return ret;
++ return !gpio_get_value(SPITZ_GPIO_KEY_INT) ||
++ gpio_get_value(SPITZ_GPIO_SYNC);
+ }
+
+ unsigned long spitzpm_read_devdata(int type)
--- /dev/null
+From 9ba63e3cc849cdaf3b675c47cc51fe35419e5117 Mon Sep 17 00:00:00 2001
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+Date: Sun, 4 Sep 2016 20:59:45 +0200
+Subject: ARM: pxa: pxa_cplds: fix interrupt handling
+
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+
+commit 9ba63e3cc849cdaf3b675c47cc51fe35419e5117 upstream.
+
+Since its initial commit, the driver is buggy for multiple interrupts
+handling. The translation from the former lubbock.c file was not
+complete, and might stall all interrupt handling when multiple
+interrupts occur.
+
+This is especially true when inside the interrupt handler and if a new
+interrupt comes and is not handled, leaving the output line still held,
+and not creating a transition as the GPIO block behind would expect to
+trigger another cplds_irq_handler() call.
+
+For the record, the hardware is working as follows.
+
+The interrupt mechanism relies on :
+ - one status register
+ - one mask register
+
+Let's suppose the input irq lines are called :
+ - i_sa1111
+ - i_lan91x
+ - i_mmc_cd
+Let's suppose the status register for each irq line is called :
+ - status_sa1111
+ - status_lan91x
+ - status_mmc_cd
+Let's suppose the interrupt mask for each irq line is called :
+ - irqen_sa1111
+ - irqen_lan91x
+ - irqen_mmc_cd
+Let's suppose the output irq line, connected to GPIO0 is called :
+ - o_gpio0
+
+The behavior is as follows :
+ - o_gpio0 = not((status_sa1111 & irqen_sa1111) |
+ (status_lan91x & irqen_lan91x) |
+ (status_mmc_cd & irqen_mmc_cd))
+ => this is a N-to-1 NOR gate and multiple AND gates
+ - irqen_* is exactly as programmed by a write to the FPGA
+ - status_* behavior is governed by a bi-stable D flip-flop
+ => on next FPGA clock :
+ - if i_xxx is high, status_xxx becomes 1
+ - if i_xxx is low, status_xxx remains as it is
+ - if software sets status_xxx to 0, the D flip-flop is reset
+ => status_xxx becomes 0
+ => on next FPGA clock cycle, if i_xxx is high, status_xxx becomes
+ 1 again
+
+Fixes: fc9e38c0f4d3 ("ARM: pxa: lubbock: use new pxa_cplds driver")
+Reported-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-pxa/pxa_cplds_irqs.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+--- a/arch/arm/mach-pxa/pxa_cplds_irqs.c
++++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c
+@@ -41,30 +41,35 @@ static irqreturn_t cplds_irq_handler(int
+ unsigned long pending;
+ unsigned int bit;
+
+- pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask;
+- for_each_set_bit(bit, &pending, CPLDS_NB_IRQ)
+- generic_handle_irq(irq_find_mapping(fpga->irqdomain, bit));
++ do {
++ pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask;
++ for_each_set_bit(bit, &pending, CPLDS_NB_IRQ) {
++ generic_handle_irq(irq_find_mapping(fpga->irqdomain,
++ bit));
++ }
++ } while (pending);
+
+ return IRQ_HANDLED;
+ }
+
+-static void cplds_irq_mask_ack(struct irq_data *d)
++static void cplds_irq_mask(struct irq_data *d)
+ {
+ struct cplds *fpga = irq_data_get_irq_chip_data(d);
+ unsigned int cplds_irq = irqd_to_hwirq(d);
+- unsigned int set, bit = BIT(cplds_irq);
++ unsigned int bit = BIT(cplds_irq);
+
+ fpga->irq_mask &= ~bit;
+ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
+- set = readl(fpga->base + FPGA_IRQ_SET_CLR);
+- writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR);
+ }
+
+ static void cplds_irq_unmask(struct irq_data *d)
+ {
+ struct cplds *fpga = irq_data_get_irq_chip_data(d);
+ unsigned int cplds_irq = irqd_to_hwirq(d);
+- unsigned int bit = BIT(cplds_irq);
++ unsigned int set, bit = BIT(cplds_irq);
++
++ set = readl(fpga->base + FPGA_IRQ_SET_CLR);
++ writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR);
+
+ fpga->irq_mask |= bit;
+ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
+@@ -72,7 +77,8 @@ static void cplds_irq_unmask(struct irq_
+
+ static struct irq_chip cplds_irq_chip = {
+ .name = "pxa_cplds",
+- .irq_mask_ack = cplds_irq_mask_ack,
++ .irq_ack = cplds_irq_mask,
++ .irq_mask = cplds_irq_mask,
+ .irq_unmask = cplds_irq_unmask,
+ .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE,
+ };
--- /dev/null
+From 67615c588a059b731df9d019edc3c561d8006ec9 Mon Sep 17 00:00:00 2001
+From: Eric Anholt <eric@anholt.net>
+Date: Wed, 1 Jun 2016 12:05:36 -0700
+Subject: clk: bcm2835: Skip PLLC clocks when deciding on a new clock parent
+
+From: Eric Anholt <eric@anholt.net>
+
+commit 67615c588a059b731df9d019edc3c561d8006ec9 upstream.
+
+If the firmware had set up a clock to source from PLLC, go along with
+it. But if we're looking for a new parent, we don't want to switch it
+to PLLC because the firmware will force PLLC (and thus the AXI bus
+clock) to different frequencies during over-temp/under-voltage,
+without notification to Linux.
+
+On my system, this moves the Linux-enabled HDMI state machine and DSI1
+escape clock over to plld_per from pllc_per. EMMC still ends up on
+pllc_per, because the firmware had set it up to use that.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: 41691b8862e2 ("clk: bcm2835: Add support for programming the audio domain clocks")
+Acked-by: Martin Sperl <kernel@martin.sperl.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/bcm/clk-bcm2835.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1006,16 +1006,28 @@ static int bcm2835_clock_set_rate(struct
+ return 0;
+ }
+
++static bool
++bcm2835_clk_is_pllc(struct clk_hw *hw)
++{
++ if (!hw)
++ return false;
++
++ return strncmp(clk_hw_get_name(hw), "pllc", 4) == 0;
++}
++
+ static int bcm2835_clock_determine_rate(struct clk_hw *hw,
+ struct clk_rate_request *req)
+ {
+ struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw);
+ struct clk_hw *parent, *best_parent = NULL;
++ bool current_parent_is_pllc;
+ unsigned long rate, best_rate = 0;
+ unsigned long prate, best_prate = 0;
+ size_t i;
+ u32 div;
+
++ current_parent_is_pllc = bcm2835_clk_is_pllc(clk_hw_get_parent(hw));
++
+ /*
+ * Select parent clock that results in the closest but lower rate
+ */
+@@ -1023,6 +1035,17 @@ static int bcm2835_clock_determine_rate(
+ parent = clk_hw_get_parent_by_index(hw, i);
+ if (!parent)
+ continue;
++
++ /*
++ * Don't choose a PLLC-derived clock as our parent
++ * unless it had been manually set that way. PLLC's
++ * frequency gets adjusted by the firmware due to
++ * over-temp or under-voltage conditions, without
++ * prior notification to our clock consumer.
++ */
++ if (bcm2835_clk_is_pllc(parent) && !current_parent_is_pllc)
++ continue;
++
+ prate = clk_hw_get_rate(parent);
+ div = bcm2835_clock_choose_div(hw, req->rate, prate, true);
+ rate = bcm2835_clock_rate_from_divisor(clock, prate, div);
--- /dev/null
+From 3174b0c9a62bb3738b4a2a506b8a075d4430e353 Mon Sep 17 00:00:00 2001
+From: Jean-Francois Moine <moinejf@free.fr>
+Date: Wed, 24 Aug 2016 08:32:51 +0200
+Subject: clk: core: Force setting the phase delay when no change
+
+From: Jean-Francois Moine <moinejf@free.fr>
+
+commit 3174b0c9a62bb3738b4a2a506b8a075d4430e353 upstream.
+
+This patch reverts commit 023bd7166be0 ("clk: skip unnecessary
+set_phase if nothing to do"), fixing two problems:
+
+* in some SoCs, the hardware phase delay depends on the rate ratio of
+ the clock and its parent. So, changing this ratio may imply to set
+ new hardware values, even if the logical delay is the same.
+
+* when the delay was the same as previously, an error was returned.
+
+Signed-off-by: Jean-Francois Moine <moinejf@free.fr>
+Fixes: 023bd7166be0 ("clk: skip unnecessary set_phase if nothing to do")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -1908,10 +1908,6 @@ int clk_set_phase(struct clk *clk, int d
+
+ clk_prepare_lock();
+
+- /* bail early if nothing to do */
+- if (degrees == clk->core->phase)
+- goto out;
+-
+ trace_clk_set_phase(clk->core, degrees);
+
+ if (clk->core->ops->set_phase)
+@@ -1922,7 +1918,6 @@ int clk_set_phase(struct clk *clk, int d
+ if (!ret)
+ clk->core->phase = degrees;
+
+-out:
+ clk_prepare_unlock();
+
+ return ret;
--- /dev/null
+From 2cf9a57811bddb6fa6b0f8d7376da164d5534813 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 12 Aug 2016 14:37:54 +0200
+Subject: clk: divider: Fix clk_divider_round_rate() to use clk_readl()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 2cf9a57811bddb6fa6b0f8d7376da164d5534813 upstream.
+
+clk-divider uses clk_readl()/clk_writel() everywhere, except in
+clk_divider_round_rate(), where plain readl() is used. Change this to
+clk_readl(), as it makes a difference on powerpc.
+
+Fixes: e6d5e7d90be92cee ("clk-divider: Fix READ_ONLY when divider > 1")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk-divider.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-divider.c
++++ b/drivers/clk/clk-divider.c
+@@ -352,7 +352,7 @@ static long clk_divider_round_rate(struc
+
+ /* if read only, just return current value */
+ if (divider->flags & CLK_DIVIDER_READ_ONLY) {
+- bestdiv = readl(divider->reg) >> divider->shift;
++ bestdiv = clk_readl(divider->reg) >> divider->shift;
+ bestdiv &= div_mask(divider->width);
+ bestdiv = _get_div(divider->table, bestdiv, divider->flags,
+ divider->width);
--- /dev/null
+From ce61966c05f276294b6be04d1765ad0d827ddefd Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Thu, 25 Aug 2016 12:20:46 +0100
+Subject: clk: gcc-msm8996: Fix pcie 2 pipe register offset
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit ce61966c05f276294b6be04d1765ad0d827ddefd upstream.
+
+This patch corrects the register offset for pcie2 pipe clock.
+Offset according to datasheet is 0x6e018 instead of 0x6e108.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/qcom/gcc-msm8996.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-msm8996.c
++++ b/drivers/clk/qcom/gcc-msm8996.c
+@@ -2592,9 +2592,9 @@ static struct clk_branch gcc_pcie_2_aux_
+ };
+
+ static struct clk_branch gcc_pcie_2_pipe_clk = {
+- .halt_reg = 0x6e108,
++ .halt_reg = 0x6e018,
+ .clkr = {
+- .enable_reg = 0x6e108,
++ .enable_reg = 0x6e018,
+ .enable_mask = BIT(0),
+ .hw.init = &(struct clk_init_data){
+ .name = "gcc_pcie_2_pipe_clk",
--- /dev/null
+From 6d91f2c0141330b919ae4d13395f38c341469564 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Thu, 25 Aug 2016 12:28:07 +0100
+Subject: clk: qcom: select GDSC for msm8996 gcc and mmcc
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit 6d91f2c0141330b919ae4d13395f38c341469564 upstream.
+
+This patch selects QCOM_GDSC Kconfig for msm8996 GCC and MMCC clock
+controllers, as these provide some of the gdscs on the SOC.
+
+Also selecting this config will make it align with other drivers which
+do the same.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Fixes: 52111672f791 ("clk: qcom: gdsc: Add GDSCs in msm8996 GCC")
+Fixes: 7e824d507909 ("clk: qcom: gdsc: Add mmcc gdscs for msm8996 family")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/qcom/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/clk/qcom/Kconfig
++++ b/drivers/clk/qcom/Kconfig
+@@ -117,6 +117,7 @@ config MSM_MMCC_8974
+
+ config MSM_GCC_8996
+ tristate "MSM8996 Global Clock Controller"
++ select QCOM_GDSC
+ depends on COMMON_CLK_QCOM
+ help
+ Support for the global clock controller on msm8996 devices.
+@@ -126,6 +127,7 @@ config MSM_GCC_8996
+ config MSM_MMCC_8996
+ tristate "MSM8996 Multimedia Clock Controller"
+ select MSM_GCC_8996
++ select QCOM_GDSC
+ depends on COMMON_CLK_QCOM
+ help
+ Support for the multimedia clock controller on msm8996 devices.
--- /dev/null
+From 8964193f6bfda5c4cf14eedb7e94892c1f1c34f0 Mon Sep 17 00:00:00 2001
+From: Tang Yuantian <Yuantian.Tang@nxp.com>
+Date: Mon, 15 Aug 2016 15:28:20 +0800
+Subject: clk: qoriq: fix a register offset error
+
+From: Tang Yuantian <Yuantian.Tang@nxp.com>
+
+commit 8964193f6bfda5c4cf14eedb7e94892c1f1c34f0 upstream.
+
+The offset of Core Cluster clock control/status register
+on cluster group V3 version is different from others, and
+should be plus 0x70000.
+
+Signed-off-by: Tang Yuantian <yuantian.tang@nxp.com>
+Reviewed-by: Scott Wood <oss@buserror.net>
+Fixes: 9e19ca2f627e ("clk: qoriq: Add ls2080a support.")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk-qoriq.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -766,7 +766,11 @@ static struct clk * __init create_one_cm
+ if (!hwc)
+ return NULL;
+
+- hwc->reg = cg->regs + 0x20 * idx;
++ if (cg->info.flags & CG_VER3)
++ hwc->reg = cg->regs + 0x70000 + 0x20 * idx;
++ else
++ hwc->reg = cg->regs + 0x20 * idx;
++
+ hwc->info = cg->info.cmux_groups[cg->info.cmux_to_group[idx]];
+
+ /*
--- /dev/null
+From f155d15b64e36b45ca89e3521fe0c1ccad5e5ff0 Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Mon, 15 Aug 2016 14:32:23 -0700
+Subject: clk: Return errors from clk providers in __of_clk_get_from_provider()
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+commit f155d15b64e36b45ca89e3521fe0c1ccad5e5ff0 upstream.
+
+Before commit 0861e5b8cf80 (clk: Add clk_hw OF clk providers,
+2016-02-05) __of_clk_get_from_provider() would return an error
+pointer of the provider's choosing if there was a provider
+registered and EPROBE_DEFER otherwise. After that commit, it
+would return EPROBE_DEFER regardless of whether or not the
+provider returned an error. This is odd and can lead to behavior
+where clk consumers keep probe deferring when they should be
+seeing some other error.
+
+Let's restore the previous behavior where we only return
+EPROBE_DEFER when there isn't a provider in our of_clk_providers
+list. Otherwise, return the error from the last provider we find
+that matches the node.
+
+Reported-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Fixes: 0861e5b8cf80 ("clk: Add clk_hw OF clk providers")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3186,7 +3186,7 @@ struct clk *__of_clk_get_from_provider(s
+ {
+ struct of_clk_provider *provider;
+ struct clk *clk = ERR_PTR(-EPROBE_DEFER);
+- struct clk_hw *hw = ERR_PTR(-EPROBE_DEFER);
++ struct clk_hw *hw;
+
+ if (!clkspec)
+ return ERR_PTR(-EINVAL);
+@@ -3194,12 +3194,13 @@ struct clk *__of_clk_get_from_provider(s
+ /* Check if we have such a provider in our array */
+ mutex_lock(&of_clk_mutex);
+ list_for_each_entry(provider, &of_clk_providers, link) {
+- if (provider->node == clkspec->np)
++ if (provider->node == clkspec->np) {
+ hw = __of_clk_get_hw_from_provider(provider, clkspec);
+- if (!IS_ERR(hw)) {
+ clk = __clk_create_clk(hw, dev_id, con_id);
++ }
+
+- if (!IS_ERR(clk) && !__clk_get(clk)) {
++ if (!IS_ERR(clk)) {
++ if (!__clk_get(clk)) {
+ __clk_free_clk(clk);
+ clk = ERR_PTR(-ENOENT);
+ }
--- /dev/null
+From a19440304db2d97aed5cee9bfa5017c98d2348bf Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Mon, 10 Oct 2016 11:06:45 -0700
+Subject: drm/vmwgfx: Avoid validating views on view destruction
+
+From: Thomas Hellstrom <thellstrom@vmware.com>
+
+commit a19440304db2d97aed5cee9bfa5017c98d2348bf upstream.
+
+When a view destruction command was present in the command stream, the
+view was validated to avoid a device error. That caused excessive and
+unnecessary validations of views, surfaces and mobs on view destruction.
+
+Replace this with a new relocation type that patches the view
+destruction command to a NOP if the view is not present in the device
+after the execbuf validation sequence.
+
+Also add checks for the member size of the vmw_res_relocation struct.
+
+Fixes sporadic command submission errors on google-earth exit.
+
+Reported-by: Brian Paul <brianp@vmware.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Brian Paul <brianp@vmware.com>
+Reviewed-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Sinclair Yeh <syeh@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 70 ++++++++++++++++++++++++++------
+ 1 file changed, 57 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -34,6 +34,24 @@
+
+ #define VMW_RES_HT_ORDER 12
+
++ /**
++ * enum vmw_resource_relocation_type - Relocation type for resources
++ *
++ * @vmw_res_rel_normal: Traditional relocation. The resource id in the
++ * command stream is replaced with the actual id after validation.
++ * @vmw_res_rel_nop: NOP relocation. The command is unconditionally replaced
++ * with a NOP.
++ * @vmw_res_rel_cond_nop: Conditional NOP relocation. If the resource id
++ * after validation is -1, the command is replaced with a NOP. Otherwise no
++ * action.
++ */
++enum vmw_resource_relocation_type {
++ vmw_res_rel_normal,
++ vmw_res_rel_nop,
++ vmw_res_rel_cond_nop,
++ vmw_res_rel_max
++};
++
+ /**
+ * struct vmw_resource_relocation - Relocation info for resources
+ *
+@@ -41,11 +59,13 @@
+ * @res: Non-ref-counted pointer to the resource.
+ * @offset: Offset of 4 byte entries into the command buffer where the
+ * id that needs fixup is located.
++ * @rel_type: Type of relocation.
+ */
+ struct vmw_resource_relocation {
+ struct list_head head;
+ const struct vmw_resource *res;
+- unsigned long offset;
++ u32 offset:29;
++ enum vmw_resource_relocation_type rel_type:3;
+ };
+
+ /**
+@@ -410,10 +430,13 @@ static int vmw_resource_context_res_add(
+ * @res: The resource.
+ * @offset: Offset into the command buffer currently being parsed where the
+ * id that needs fixup is located. Granularity is 4 bytes.
++ * @rel_type: Relocation type.
+ */
+ static int vmw_resource_relocation_add(struct list_head *list,
+ const struct vmw_resource *res,
+- unsigned long offset)
++ unsigned long offset,
++ enum vmw_resource_relocation_type
++ rel_type)
+ {
+ struct vmw_resource_relocation *rel;
+
+@@ -425,6 +448,7 @@ static int vmw_resource_relocation_add(s
+
+ rel->res = res;
+ rel->offset = offset;
++ rel->rel_type = rel_type;
+ list_add_tail(&rel->head, list);
+
+ return 0;
+@@ -459,11 +483,23 @@ static void vmw_resource_relocations_app
+ {
+ struct vmw_resource_relocation *rel;
+
++ /* Validate the struct vmw_resource_relocation member size */
++ BUILD_BUG_ON(SVGA_CB_MAX_SIZE >= (1 << 29));
++ BUILD_BUG_ON(vmw_res_rel_max >= (1 << 3));
++
+ list_for_each_entry(rel, list, head) {
+- if (likely(rel->res != NULL))
++ switch (rel->rel_type) {
++ case vmw_res_rel_normal:
+ cb[rel->offset] = rel->res->id;
+- else
++ break;
++ case vmw_res_rel_nop:
+ cb[rel->offset] = SVGA_3D_CMD_NOP;
++ break;
++ default:
++ if (rel->res->id == -1)
++ cb[rel->offset] = SVGA_3D_CMD_NOP;
++ break;
++ }
+ }
+ }
+
+@@ -655,7 +691,8 @@ static int vmw_cmd_res_reloc_add(struct
+ *p_val = NULL;
+ ret = vmw_resource_relocation_add(&sw_context->res_relocations,
+ res,
+- id_loc - sw_context->buf_start);
++ id_loc - sw_context->buf_start,
++ vmw_res_rel_normal);
+ if (unlikely(ret != 0))
+ return ret;
+
+@@ -721,7 +758,8 @@ vmw_cmd_res_check(struct vmw_private *de
+
+ return vmw_resource_relocation_add
+ (&sw_context->res_relocations, res,
+- id_loc - sw_context->buf_start);
++ id_loc - sw_context->buf_start,
++ vmw_res_rel_normal);
+ }
+
+ ret = vmw_user_resource_lookup_handle(dev_priv,
+@@ -2144,7 +2182,8 @@ static int vmw_cmd_shader_define(struct
+
+ return vmw_resource_relocation_add(&sw_context->res_relocations,
+ NULL, &cmd->header.id -
+- sw_context->buf_start);
++ sw_context->buf_start,
++ vmw_res_rel_nop);
+
+ return 0;
+ }
+@@ -2189,7 +2228,8 @@ static int vmw_cmd_shader_destroy(struct
+
+ return vmw_resource_relocation_add(&sw_context->res_relocations,
+ NULL, &cmd->header.id -
+- sw_context->buf_start);
++ sw_context->buf_start,
++ vmw_res_rel_nop);
+
+ return 0;
+ }
+@@ -2848,8 +2888,7 @@ static int vmw_cmd_dx_cid_check(struct v
+ * @header: Pointer to the command header in the command stream.
+ *
+ * Check that the view exists, and if it was not created using this
+- * command batch, make sure it's validated (present in the device) so that
+- * the remove command will not confuse the device.
++ * command batch, conditionally make this command a NOP.
+ */
+ static int vmw_cmd_dx_view_remove(struct vmw_private *dev_priv,
+ struct vmw_sw_context *sw_context,
+@@ -2877,10 +2916,15 @@ static int vmw_cmd_dx_view_remove(struct
+ return ret;
+
+ /*
+- * Add view to the validate list iff it was not created using this
+- * command batch.
++ * If the view wasn't created during this command batch, it might
++ * have been removed due to a context swapout, so add a
++ * relocation to conditionally make this command a NOP to avoid
++ * device errors.
+ */
+- return vmw_view_res_val_add(sw_context, view);
++ return vmw_resource_relocation_add(&sw_context->res_relocations,
++ view,
++ &cmd->header.id - sw_context->buf_start,
++ vmw_res_rel_cond_nop);
+ }
+
+ /**
--- /dev/null
+From a6c934b364948cd4de5bd9ab055bb65206ec70f3 Mon Sep 17 00:00:00 2001
+From: Haim Dreyfuss <haim.dreyfuss@intel.com>
+Date: Tue, 2 Aug 2016 15:28:23 +0300
+Subject: iwlwifi: check for valid ethernet address provided by OEM
+
+From: Haim Dreyfuss <haim.dreyfuss@intel.com>
+
+commit a6c934b364948cd4de5bd9ab055bb65206ec70f3 upstream.
+
+In 9000 family products we added an option to let the OEM fuse the
+mac address via registers. If these registers are zeroed we use the OTP
+address instead. Make sure that the address provided by the OEM is valid
+and, if not, fall back to the OTP address as well.
+
+Fixes: commit 17c867bfe89b ("iwlwifi: add support for getting HW address from CSR")
+Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -564,11 +564,16 @@ static void iwl_set_hw_address_from_csr(
+ __le32 mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_STRAP));
+ __le32 mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_STRAP));
+
+- /* If OEM did not fuse address - get it from OTP */
+- if (!mac_addr0 && !mac_addr1) {
+- mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
+- mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
+- }
++ iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
++ /*
++ * If the OEM fused a valid address, use it instead of the one in the
++ * OTP
++ */
++ if (is_valid_ether_addr(data->hw_addr))
++ return;
++
++ mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP));
++ mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP));
+
+ iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr);
+ }
--- /dev/null
+From 75cfe338b8a6fadaa28879a969047554701a7589 Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Wed, 14 Sep 2016 11:54:36 +0300
+Subject: iwlwifi: mvm: bail out if CTDP start operation fails
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+commit 75cfe338b8a6fadaa28879a969047554701a7589 upstream.
+
+We were assigning the return value of iwl_mvm_ctdp_command() to a
+variable, but never checking it. If this command fails, we should not
+allow the interface up process to proceed, since it is potentially
+dangerous to ignore thermal management requirements.
+
+Fixes: commit 5c89e7bc557e ("iwlwifi: mvm: add registration to cooling device")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -1214,9 +1214,12 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
+ }
+
+ /* TODO: read the budget from BIOS / Platform NVM */
+- if (iwl_mvm_is_ctdp_supported(mvm) && mvm->cooling_dev.cur_state > 0)
++ if (iwl_mvm_is_ctdp_supported(mvm) && mvm->cooling_dev.cur_state > 0) {
+ ret = iwl_mvm_ctdp_command(mvm, CTDP_CMD_OPERATION_START,
+ mvm->cooling_dev.cur_state);
++ if (ret)
++ goto error;
++ }
+ #else
+ /* Initialize tx backoffs to the minimal possible */
+ iwl_mvm_tt_tx_backoff(mvm, 0);
--- /dev/null
+From ca3b9c6b6d4db9a8ba5fc8b95664e75468c59f9f Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Thu, 30 Jun 2016 16:14:02 +0300
+Subject: iwlwifi: mvm: call a different txq_enable function
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+commit ca3b9c6b6d4db9a8ba5fc8b95664e75468c59f9f upstream.
+
+Since the SCD_QUEUE_CFG command was introduced the driver
+calls iwl_trans_txq_enable_cfg() with a NULL for scd_cfg
+parameter.
+This makes the transport avoid writing to the SCD pointers,
+since it can cause races with firmware, which is also accessing
+the registers.
+The transport only updates the write pointer in that case.
+Fix a wrong call to iwl_trans_txq_enable() which caused a
+scd_cfg parameter to be sent to transport, resulting with an
+access to SCD registers.
+
+Fixes: 58f2cc57dc6a ("iwlwifi: mvm: support dqa-mode scd queue redirection")
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -576,9 +576,7 @@ static int iwl_mvm_scd_queue_redirect(st
+ ret);
+
+ /* Make sure the SCD wrptr is correctly set before reconfiguring */
+- iwl_trans_txq_enable(mvm->trans, queue, iwl_mvm_ac_to_tx_fifo[ac],
+- cmd.sta_id, tid, LINK_QUAL_AGG_FRAME_LIMIT_DEF,
+- ssn, wdg_timeout);
++ iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, NULL, wdg_timeout);
+
+ /* TODO: Work-around SCD bug when moving back by multiples of 0x40 */
+
--- /dev/null
+From 341d7eb8223bdd48bdf75729487a2de5e01623b3 Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Thu, 18 Aug 2016 20:14:38 +0300
+Subject: iwlwifi: mvm: disable P2P queue on mac context release
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+commit 341d7eb8223bdd48bdf75729487a2de5e01623b3 upstream.
+
+AP queue is properly released, but P2P queue isn't.
+
+Fixes: commit 4c965139a3cd ("iwlwifi: mvm: support p2p device frames tx on dqa queue #2")
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c
+@@ -539,6 +539,11 @@ void iwl_mvm_mac_ctxt_release(struct iwl
+ iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE,
+ IWL_MVM_OFFCHANNEL_QUEUE,
+ IWL_MAX_TID_COUNT, 0);
++ else
++ iwl_mvm_disable_txq(mvm,
++ IWL_MVM_DQA_P2P_DEVICE_QUEUE,
++ vif->hw_queue[0], IWL_MAX_TID_COUNT,
++ 0);
+
+ break;
+ case NL80211_IFTYPE_AP:
--- /dev/null
+From 7585c354637bb003ce612dd22f5047c015545ef4 Mon Sep 17 00:00:00 2001
+From: Liad Kaufman <liad.kaufman@intel.com>
+Date: Thu, 7 Jul 2016 11:00:26 +0300
+Subject: iwlwifi: mvm: fix pending frames tracking on tx resp
+
+From: Liad Kaufman <liad.kaufman@intel.com>
+
+commit 7585c354637bb003ce612dd22f5047c015545ef4 upstream.
+
+In iwl_mvm_rx_tx_cmd_single(), when checking if a given TID is
+aggregated, the driver doesn't check whether or not the queue
+itself can be aggregated. For example, a management queue might
+be marked as aggregated if TID 0 is aggregated on a (different)
+data queue.
+
+Make sure that mgmt frames are sent with TID IWL_TID_NON_QOS,
+and in this way make sure no mixups of this sort happen.
+
+Fixes: commit 24afba7690e4 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of queues")
+Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -903,9 +903,13 @@ static int iwl_mvm_tx_mpdu(struct iwl_mv
+ tid = IWL_MAX_TID_COUNT;
+ }
+
+- if (iwl_mvm_is_dqa_supported(mvm))
++ if (iwl_mvm_is_dqa_supported(mvm)) {
+ txq_id = mvmsta->tid_data[tid].txq_id;
+
++ if (ieee80211_is_mgmt(fc))
++ tx_cmd->tid_tspec = IWL_TID_NON_QOS;
++ }
++
+ /* Copy MAC header from skb into command buffer */
+ memcpy(tx_cmd->hdr, hdr, hdrlen);
+
--- /dev/null
+From a0315dea9091d1ebc1534f6129b3fc9942b8ca99 Mon Sep 17 00:00:00 2001
+From: Liad Kaufman <liad.kaufman@intel.com>
+Date: Thu, 7 Jul 2016 13:25:59 +0300
+Subject: iwlwifi: mvm: free reserved queue on STA removal
+
+From: Liad Kaufman <liad.kaufman@intel.com>
+
+commit a0315dea9091d1ebc1534f6129b3fc9942b8ca99 upstream.
+
+When a STA is removed in DQA mode, if no traffic went through
+its reserved queue, the txq continues to be marked as
+reserved and no STA can use it.
+
+Make sure that in such a case the reserved queue is marked
+as free when the STA is removed.
+
+Fixes: commit 24afba7690e4 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of queues")
+Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 24 +++++++++++++++++++++++-
+ 1 file changed, 23 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -1268,9 +1268,31 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
+ ret = iwl_mvm_drain_sta(mvm, mvm_sta, false);
+
+ /* If DQA is supported - the queues can be disabled now */
+- if (iwl_mvm_is_dqa_supported(mvm))
++ if (iwl_mvm_is_dqa_supported(mvm)) {
++ u8 reserved_txq = mvm_sta->reserved_queue;
++ enum iwl_mvm_queue_status *status;
++
+ iwl_mvm_disable_sta_queues(mvm, vif, mvm_sta);
+
++ /*
++ * If no traffic has gone through the reserved TXQ - it
++ * is still marked as IWL_MVM_QUEUE_RESERVED, and
++ * should be manually marked as free again
++ */
++ spin_lock_bh(&mvm->queue_info_lock);
++ status = &mvm->queue_info[reserved_txq].status;
++ if (WARN((*status != IWL_MVM_QUEUE_RESERVED) &&
++ (*status != IWL_MVM_QUEUE_FREE),
++ "sta_id %d reserved txq %d status %d",
++ mvm_sta->sta_id, reserved_txq, *status)) {
++ spin_unlock_bh(&mvm->queue_info_lock);
++ return -EINVAL;
++ }
++
++ *status = IWL_MVM_QUEUE_FREE;
++ spin_unlock_bh(&mvm->queue_info_lock);
++ }
++
+ if (vif->type == NL80211_IFTYPE_STATION &&
+ mvmvif->ap_sta_id == mvm_sta->sta_id) {
+ /* if associated - we can't remove the AP STA now */
--- /dev/null
+From 9a73a7d24d51eaf9e43c771c53cf7b594e5b5334 Mon Sep 17 00:00:00 2001
+From: Sara Sharon <sara.sharon@intel.com>
+Date: Mon, 8 Aug 2016 13:07:01 +0300
+Subject: iwlwifi: mvm: support BAR in reorder buffer
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+commit 9a73a7d24d51eaf9e43c771c53cf7b594e5b5334 upstream.
+
+On default queue we will not receive frame release notification,
+but the BAR itself.
+Upon receiving the BAR driver should look at the NSSN and adjust
+window accordingly.
+
+Fixes: b915c10174fb ("iwlwifi: mvm: add reorder buffer per queue")
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -598,9 +598,10 @@ static bool iwl_mvm_reorder(struct iwl_m
+
+ mvm_sta = iwl_mvm_sta_from_mac80211(sta);
+
+- /* not a data packet */
+- if (!ieee80211_is_data_qos(hdr->frame_control) ||
+- is_multicast_ether_addr(hdr->addr1))
++ /* not a data packet or a bar */
++ if (!ieee80211_is_back_req(hdr->frame_control) &&
++ (!ieee80211_is_data_qos(hdr->frame_control) ||
++ is_multicast_ether_addr(hdr->addr1)))
+ return false;
+
+ if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+@@ -624,6 +625,11 @@ static bool iwl_mvm_reorder(struct iwl_m
+
+ spin_lock_bh(&buffer->lock);
+
++ if (ieee80211_is_back_req(hdr->frame_control)) {
++ iwl_mvm_release_frames(mvm, sta, napi, buffer, nssn);
++ goto drop;
++ }
++
+ /*
+ * If there was a significant jump in the nssn - adjust.
+ * If the SN is smaller than the NSSN it might need to first go into
--- /dev/null
+From e046114af5fcafe8d6d3f0b6ccb99804bad34bfb Mon Sep 17 00:00:00 2001
+From: Vishal Verma <vishal.l.verma@intel.com>
+Date: Fri, 30 Sep 2016 17:19:31 -0600
+Subject: libnvdimm: clear the internal poison_list when clearing badblocks
+
+From: Vishal Verma <vishal.l.verma@intel.com>
+
+commit e046114af5fcafe8d6d3f0b6ccb99804bad34bfb upstream.
+
+nvdimm_clear_poison cleared the user-visible badblocks, and sent
+commands to the NVDIMM to clear the areas marked as 'poison', but it
+neglected to clear the same areas from the internal poison_list which is
+used to marshal ARS results before sorting them by namespace. As a
+result, once on-demand ARS functionality was added:
+
+37b137f nfit, libnvdimm: allow an ARS scrub to be triggered on demand
+
+A scrub triggered from either sysfs or an MCE was found to be adding
+stale entries that had been cleared from gendisk->badblocks, but were
+still present in nvdimm_bus->poison_list. Additionally, the stale entries
+could be triggered into producing stale disk->badblocks by simply disabling
+and re-enabling the namespace or region.
+
+This adds the missing step of clearing poison_list entries when clearing
+poison, so that it is always in sync with badblocks.
+
+Fixes: 37b137f ("nfit, libnvdimm: allow an ARS scrub to be triggered on demand")
+Signed-off-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvdimm/bus.c | 2 +
+ drivers/nvdimm/core.c | 73 +++++++++++++++++++++++++++++++++++++++++++---
+ include/linux/libnvdimm.h | 2 +
+ 3 files changed, 73 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -217,6 +217,8 @@ long nvdimm_clear_poison(struct device *
+ return rc;
+ if (cmd_rc < 0)
+ return cmd_rc;
++
++ nvdimm_clear_from_poison_list(nvdimm_bus, phys, len);
+ return clear_err.cleared;
+ }
+ EXPORT_SYMBOL_GPL(nvdimm_clear_poison);
+--- a/drivers/nvdimm/core.c
++++ b/drivers/nvdimm/core.c
+@@ -547,11 +547,12 @@ void nvdimm_badblocks_populate(struct nd
+ }
+ EXPORT_SYMBOL_GPL(nvdimm_badblocks_populate);
+
+-static int add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
++static int add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length,
++ gfp_t flags)
+ {
+ struct nd_poison *pl;
+
+- pl = kzalloc(sizeof(*pl), GFP_KERNEL);
++ pl = kzalloc(sizeof(*pl), flags);
+ if (!pl)
+ return -ENOMEM;
+
+@@ -567,7 +568,7 @@ static int bus_add_poison(struct nvdimm_
+ struct nd_poison *pl;
+
+ if (list_empty(&nvdimm_bus->poison_list))
+- return add_poison(nvdimm_bus, addr, length);
++ return add_poison(nvdimm_bus, addr, length, GFP_KERNEL);
+
+ /*
+ * There is a chance this is a duplicate, check for those first.
+@@ -587,7 +588,7 @@ static int bus_add_poison(struct nvdimm_
+ * as any overlapping ranges will get resolved when the list is consumed
+ * and converted to badblocks
+ */
+- return add_poison(nvdimm_bus, addr, length);
++ return add_poison(nvdimm_bus, addr, length, GFP_KERNEL);
+ }
+
+ int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length)
+@@ -602,6 +603,70 @@ int nvdimm_bus_add_poison(struct nvdimm_
+ }
+ EXPORT_SYMBOL_GPL(nvdimm_bus_add_poison);
+
++void nvdimm_clear_from_poison_list(struct nvdimm_bus *nvdimm_bus,
++ phys_addr_t start, unsigned int len)
++{
++ struct list_head *poison_list = &nvdimm_bus->poison_list;
++ u64 clr_end = start + len - 1;
++ struct nd_poison *pl, *next;
++
++ nvdimm_bus_lock(&nvdimm_bus->dev);
++ WARN_ON_ONCE(list_empty(poison_list));
++
++ /*
++ * [start, clr_end] is the poison interval being cleared.
++ * [pl->start, pl_end] is the poison_list entry we're comparing
++ * the above interval against. The poison list entry may need
++ * to be modified (update either start or length), deleted, or
++ * split into two based on the overlap characteristics
++ */
++
++ list_for_each_entry_safe(pl, next, poison_list, list) {
++ u64 pl_end = pl->start + pl->length - 1;
++
++ /* Skip intervals with no intersection */
++ if (pl_end < start)
++ continue;
++ if (pl->start > clr_end)
++ continue;
++ /* Delete completely overlapped poison entries */
++ if ((pl->start >= start) && (pl_end <= clr_end)) {
++ list_del(&pl->list);
++ kfree(pl);
++ continue;
++ }
++ /* Adjust start point of partially cleared entries */
++ if ((start <= pl->start) && (clr_end > pl->start)) {
++ pl->length -= clr_end - pl->start + 1;
++ pl->start = clr_end + 1;
++ continue;
++ }
++ /* Adjust pl->length for partial clearing at the tail end */
++ if ((pl->start < start) && (pl_end <= clr_end)) {
++ /* pl->start remains the same */
++ pl->length = start - pl->start;
++ continue;
++ }
++ /*
++ * If clearing in the middle of an entry, we split it into
++ * two by modifying the current entry to represent one half of
++ * the split, and adding a new entry for the second half.
++ */
++ if ((pl->start < start) && (pl_end > clr_end)) {
++ u64 new_start = clr_end + 1;
++ u64 new_len = pl_end - new_start + 1;
++
++ /* Add new entry covering the right half */
++ add_poison(nvdimm_bus, new_start, new_len, GFP_NOIO);
++ /* Adjust this entry to cover the left half */
++ pl->length = start - pl->start;
++ continue;
++ }
++ }
++ nvdimm_bus_unlock(&nvdimm_bus->dev);
++}
++EXPORT_SYMBOL_GPL(nvdimm_clear_from_poison_list);
++
+ #ifdef CONFIG_BLK_DEV_INTEGRITY
+ int nd_integrity_init(struct gendisk *disk, unsigned long meta_size)
+ {
+--- a/include/linux/libnvdimm.h
++++ b/include/linux/libnvdimm.h
+@@ -129,6 +129,8 @@ static inline struct nd_blk_region_desc
+ }
+
+ int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length);
++void nvdimm_clear_from_poison_list(struct nvdimm_bus *nvdimm_bus,
++ phys_addr_t start, unsigned int len);
+ struct nvdimm_bus *nvdimm_bus_register(struct device *parent,
+ struct nvdimm_bus_descriptor *nfit_desc);
+ void nvdimm_bus_unregister(struct nvdimm_bus *nvdimm_bus);
--- /dev/null
+From 0d667f72b2a20bbac72bec0ab11467fc70bb0f1f Mon Sep 17 00:00:00 2001
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Date: Wed, 3 Aug 2016 15:00:18 +0200
+Subject: mpt3sas: Don't spam logs if logging level is 0
+
+From: Johannes Thumshirn <jthumshirn@suse.de>
+
+commit 0d667f72b2a20bbac72bec0ab11467fc70bb0f1f upstream.
+
+In _scsih_io_done() we test if the ioc->logging_level does _not_ have
+the MPT_DEBUG_REPLY bit set and if it hasn't we print the debug
+messages. This unfortunately is the wrong way around.
+
+Note, the actual bug is older than af0094115 but this commit removed the
+CONFIG_SCSI_MPT3SAS_LOGGING Kconfig option which hid the bug.
+
+Fixes: af0094115 'mpt2sas, mpt3sas: Remove SCSI_MPTXSAS_LOGGING entry from Kconfig'
+Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
+Acked-by: Chaitra P B <chaitra.basappa@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -4701,7 +4701,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *i
+ le16_to_cpu(mpi_reply->DevHandle));
+ mpt3sas_trigger_scsi(ioc, data.skey, data.asc, data.ascq);
+
+- if (!(ioc->logging_level & MPT_DEBUG_REPLY) &&
++ if ((ioc->logging_level & MPT_DEBUG_REPLY) &&
+ ((scmd->sense_buffer[2] == UNIT_ATTENTION) ||
+ (scmd->sense_buffer[2] == MEDIUM_ERROR) ||
+ (scmd->sense_buffer[2] == HARDWARE_ERROR)))
--- /dev/null
+From db047f8a931275e50563dd79c3d62d977074959a Mon Sep 17 00:00:00 2001
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Date: Mon, 15 Aug 2016 17:50:41 +0100
+Subject: PCI: aardvark: Fix pci_remap_iospace() failure path
+
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+
+commit db047f8a931275e50563dd79c3d62d977074959a upstream.
+
+On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped
+IO, by reserving a chunk of virtual address space starting at PCI_IOBASE
+and by mapping the PCI host bridge's memory address space driving PCI IO
+cycles to it.
+
+PCI host bridge drivers that enable downstream PCI IO cycles map the host
+bridge memory address responding to PCI IO cycles to the fixed virtual
+address space through the pci_remap_iospace() API.
+
+This means that if the pci_remap_iospace() function fails, the
+corresponding host bridge PCI IO resource must be considered invalid, in
+that there is no way for the kernel to actually drive PCI IO transactions
+if the memory addresses responding to PCI IO cycles cannot be mapped into
+the CPU virtual address space.
+
+The PCI aardvark host bridge driver does not remove the PCI IO resource
+from the host bridge resource windows if the pci_remap_iospace() call
+fails; this is an actual bug in that the PCI host bridge would consider the
+PCI IO resource valid (and possibly assign it to downstream devices) even
+if the kernel was not able to map the PCI host bridge memory address
+driving IO cycle to the CPU virtual address space (ie pci_remap_iospace()
+failures).
+
+Fix the PCI host bridge driver pci_remap_iospace() failure path, by
+destroying the PCI host bridge PCI IO resources retrieved through firmware
+when the pci_remap_iospace() function call fails, therefore preventing the
+kernel from adding the respective PCI IO resource to the list of PCI host
+bridge valid resources, fixing the issue.
+
+Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver")
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pci-aardvark.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/host/pci-aardvark.c
++++ b/drivers/pci/host/pci-aardvark.c
+@@ -848,7 +848,7 @@ static int advk_pcie_parse_request_of_pc
+ int err, res_valid = 0;
+ struct device *dev = &pcie->pdev->dev;
+ struct device_node *np = dev->of_node;
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+ resource_size_t iobase;
+
+ INIT_LIST_HEAD(&pcie->resources);
+@@ -862,7 +862,7 @@ static int advk_pcie_parse_request_of_pc
+ if (err)
+ goto out_release_res;
+
+- resource_list_for_each_entry(win, &pcie->resources) {
++ resource_list_for_each_entry_safe(win, tmp, &pcie->resources) {
+ struct resource *res = win->res;
+
+ switch (resource_type(res)) {
+@@ -874,9 +874,11 @@ static int advk_pcie_parse_request_of_pc
+ lower_32_bits(res->start),
+ OB_PCIE_IO);
+ err = pci_remap_iospace(res, iobase);
+- if (err)
++ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
++ resource_list_destroy_entry(win);
++ }
+ break;
+ case IORESOURCE_MEM:
+ advk_pcie_set_ob_win(pcie, 0,
--- /dev/null
+From bcd7b7186fcba434e7486648de85cf93a56c845c Mon Sep 17 00:00:00 2001
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Date: Mon, 15 Aug 2016 17:50:42 +0100
+Subject: PCI: designware: Fix pci_remap_iospace() failure path
+
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+
+commit bcd7b7186fcba434e7486648de85cf93a56c845c upstream.
+
+On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped
+IO, by reserving a chunk of virtual address space starting at PCI_IOBASE
+and by mapping the PCI host bridges memory address space driving PCI IO
+cycles to it.
+
+PCI host bridge drivers that enable downstream PCI IO cycles map the host
+bridge memory address responding to PCI IO cycles to the fixed virtual
+address space through the pci_remap_iospace() API.
+
+This means that if the pci_remap_iospace() function fails, the
+corresponding host bridge PCI IO resource must be considered invalid, in
+that there is no way for the kernel to actually drive PCI IO transactions
+if the memory addresses responding to PCI IO cycles cannot be mapped into
+the CPU virtual address space.
+
+The PCI designware host bridge driver does not remove the PCI IO resource
+from the host bridge resource windows if the pci_remap_iospace() call
+fails; this is an actual bug in that the PCI host bridge would consider the
+PCI IO resource valid (and possibly assign it to downstream devices) even
+if the kernel was not able to map the PCI host bridge memory address
+driving IO cycle to the CPU virtual address space (ie pci_remap_iospace()
+failures).
+
+Fix the PCI host bridge driver pci_remap_iospace() failure path, by
+destroying the PCI host bridge PCI IO resources retrieved through firmware
+when the pci_remap_iospace() function call fails, therefore preventing the
+kernel from adding the respective PCI IO resource to the list of PCI host
+bridge valid resources, fixing the issue.
+
+Fixes: cbce7900598c ("PCI: designware: Make driver arch-agnostic")
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Jingoo Han <jingoohan1@gmail.com>
+CC: Pratyush Anand <pratyush.anand@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pcie-designware.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+--- a/drivers/pci/host/pcie-designware.c
++++ b/drivers/pci/host/pcie-designware.c
+@@ -436,7 +436,7 @@ int dw_pcie_host_init(struct pcie_port *
+ struct resource *cfg_res;
+ int i, ret;
+ LIST_HEAD(res);
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+
+ cfg_res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "config");
+ if (cfg_res) {
+@@ -457,17 +457,20 @@ int dw_pcie_host_init(struct pcie_port *
+ goto error;
+
+ /* Get the I/O and memory ranges from DT */
+- resource_list_for_each_entry(win, &res) {
++ resource_list_for_each_entry_safe(win, tmp, &res) {
+ switch (resource_type(win->res)) {
+ case IORESOURCE_IO:
+- pp->io = win->res;
+- pp->io->name = "I/O";
+- pp->io_size = resource_size(pp->io);
+- pp->io_bus_addr = pp->io->start - win->offset;
+- ret = pci_remap_iospace(pp->io, pp->io_base);
+- if (ret)
++ ret = pci_remap_iospace(win->res, pp->io_base);
++ if (ret) {
+ dev_warn(pp->dev, "error %d: failed to map resource %pR\n",
+- ret, pp->io);
++ ret, win->res);
++ resource_list_destroy_entry(win);
++ } else {
++ pp->io = win->res;
++ pp->io->name = "I/O";
++ pp->io_size = resource_size(pp->io);
++ pp->io_bus_addr = pp->io->start - win->offset;
++ }
+ break;
+ case IORESOURCE_MEM:
+ pp->mem = win->res;
--- /dev/null
+From 43281ede019ede33fd0c40a14a86b304a51e4555 Mon Sep 17 00:00:00 2001
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Date: Mon, 15 Aug 2016 17:50:45 +0100
+Subject: PCI: generic: Fix pci_remap_iospace() failure path
+
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+
+commit 43281ede019ede33fd0c40a14a86b304a51e4555 upstream.
+
+On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped
+IO, by reserving a chunk of virtual address space starting at PCI_IOBASE
+and by mapping the PCI host bridges memory address space driving PCI IO
+cycles to it.
+
+PCI host bridge drivers that enable downstream PCI IO cycles map the host
+bridge memory address responding to PCI IO cycles to the fixed virtual
+address space through the pci_remap_iospace() API.
+
+This means that if the pci_remap_iospace() function fails, the
+corresponding host bridge PCI IO resource must be considered invalid, in
+that there is no way for the kernel to actually drive PCI IO transactions
+if the memory addresses responding to PCI IO cycles cannot be mapped into
+the CPU virtual address space.
+
+The PCI common host bridge driver does not remove the PCI IO resource from
+the host bridge resource windows if the pci_remap_iospace() call fails;
+this is an actual bug in that the PCI host bridge would consider the PCI IO
+resource valid (and possibly assign it to downstream devices) even if the
+kernel was not able to map the PCI host bridge memory address driving IO
+cycle to the CPU virtual address space (ie pci_remap_iospace() failures).
+
+Fix the PCI host bridge driver pci_remap_iospace() failure path, by
+destroying the PCI host bridge PCI IO resources retrieved through firmware
+when the pci_remap_iospace() function call fails, therefore preventing the
+kernel from adding the respective PCI IO resource to the list of PCI host
+bridge valid resources, fixing the issue.
+
+Fixes: 4e64dbe226e7 ("PCI: generic: Expose pci_host_common_probe() for use by other drivers")
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pci-host-common.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/host/pci-host-common.c
++++ b/drivers/pci/host/pci-host-common.c
+@@ -29,7 +29,7 @@ static int gen_pci_parse_request_of_pci_
+ int err, res_valid = 0;
+ struct device_node *np = dev->of_node;
+ resource_size_t iobase;
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+
+ err = of_pci_get_host_bridge_resources(np, 0, 0xff, resources, &iobase);
+ if (err)
+@@ -39,15 +39,17 @@ static int gen_pci_parse_request_of_pci_
+ if (err)
+ return err;
+
+- resource_list_for_each_entry(win, resources) {
++ resource_list_for_each_entry_safe(win, tmp, resources) {
+ struct resource *res = win->res;
+
+ switch (resource_type(res)) {
+ case IORESOURCE_IO:
+ err = pci_remap_iospace(res, iobase);
+- if (err)
++ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
++ resource_list_destroy_entry(win);
++ }
+ break;
+ case IORESOURCE_MEM:
+ res_valid |= !(res->flags & IORESOURCE_PREFETCH);
--- /dev/null
+From 5e8c873270cc618e3326eb6a47437b517ef85c52 Mon Sep 17 00:00:00 2001
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Date: Mon, 15 Aug 2016 17:50:44 +0100
+Subject: PCI: rcar: Fix pci_remap_iospace() failure path
+
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+
+commit 5e8c873270cc618e3326eb6a47437b517ef85c52 upstream.
+
+On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped
+IO, by reserving a chunk of virtual address space starting at PCI_IOBASE
+and by mapping the PCI host bridges memory address space driving PCI IO
+cycles to it.
+
+PCI host bridge drivers that enable downstream PCI IO cycles map the host
+bridge memory address responding to PCI IO cycles to the fixed virtual
+address space through the pci_remap_iospace() API.
+
+This means that if the pci_remap_iospace() function fails, the
+corresponding host bridge PCI IO resource must be considered invalid, in
+that there is no way for the kernel to actually drive PCI IO transactions
+if the memory addresses responding to PCI IO cycles cannot be mapped into
+the CPU virtual address space.
+
+The PCI rcar host bridge driver does not remove the PCI IO resource from
+the host bridge resource windows if the pci_remap_iospace() call fails;
+this is an actual bug in that the PCI host bridge would consider the PCI IO
+resource valid (and possibly assign it to downstream devices) even if the
+kernel was not able to map the PCI host bridge memory address driving IO
+cycle to the CPU virtual address space (ie pci_remap_iospace() failures).
+
+Fix the PCI host bridge driver pci_remap_iospace() failure path, by
+destroying the PCI host bridge PCI IO resources retrieved through firmware
+when the pci_remap_iospace() function call fails, therefore preventing the
+kernel from adding the respective PCI IO resource to the list of PCI host
+bridge valid resources, fixing the issue.
+
+Fixes: 5d2917d469fa ("PCI: rcar: Convert to DT resource parsing API")
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Phil Edworthy <phil.edworthy@renesas.com>
+CC: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pcie-rcar.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/host/pcie-rcar.c
++++ b/drivers/pci/host/pcie-rcar.c
+@@ -945,7 +945,7 @@ static int rcar_pcie_parse_request_of_pc
+ struct device *dev = pci->dev;
+ struct device_node *np = dev->of_node;
+ resource_size_t iobase;
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+
+ err = of_pci_get_host_bridge_resources(np, 0, 0xff, &pci->resources, &iobase);
+ if (err)
+@@ -955,14 +955,17 @@ static int rcar_pcie_parse_request_of_pc
+ if (err)
+ goto out_release_res;
+
+- resource_list_for_each_entry(win, &pci->resources) {
++ resource_list_for_each_entry_safe(win, tmp, &pci->resources) {
+ struct resource *res = win->res;
+
+ if (resource_type(res) == IORESOURCE_IO) {
+ err = pci_remap_iospace(res, iobase);
+- if (err)
++ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
++
++ resource_list_destroy_entry(win);
++ }
+ }
+ }
+
--- /dev/null
+From 13f392ebc37e31568fae72a73ee378ae22a9740f Mon Sep 17 00:00:00 2001
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Date: Mon, 15 Aug 2016 17:50:46 +0100
+Subject: PCI: tegra: Fix pci_remap_iospace() failure path
+
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+
+commit 13f392ebc37e31568fae72a73ee378ae22a9740f upstream.
+
+On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped
+IO, by reserving a chunk of virtual address space starting at PCI_IOBASE
+and by mapping the PCI host bridges memory address space driving PCI IO
+cycles to it.
+
+PCI host bridge drivers that enable downstream PCI IO cycles map the host
+bridge memory address responding to PCI IO cycles to the fixed virtual
+address space through the pci_remap_iospace() API.
+
+This means that if the pci_remap_iospace() function fails, the
+corresponding host bridge PCI IO resource must be considered invalid, in
+that there is no way for the kernel to actually drive PCI IO transactions
+if the memory addresses responding to PCI IO cycles cannot be mapped into
+the CPU virtual address space.
+
+The PCI tegra host bridge driver adds the PCI IO resource retrieved from
+firmware to the host bridge resource windows even if the
+pci_remap_iospace() call fails; this is an actual bug in that the PCI host
+bridge would consider the PCI IO resource valid (and possibly assign it to
+downstream devices) even if the kernel was not able to map the PCI host
+bridge memory address driving IO cycle to the CPU virtual address space (ie
+pci_remap_iospace() failures).
+
+Add the PCI host bridge driver pci_remap_iospace() failure path and do not
+add the corresponding PCI host bridge PCI IO resources retrieved through
+firmware when the pci_remap_iospace() function call fails, fixing the
+issue.
+
+Fixes: e6e9f471f5fe ("PCI: tegra: Use generic pci_remap_iospace() rather than ARM32-specific one")
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pci-tegra.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/host/pci-tegra.c
++++ b/drivers/pci/host/pci-tegra.c
+@@ -621,7 +621,11 @@ static int tegra_pcie_setup(int nr, stru
+ if (err < 0)
+ return err;
+
+- pci_add_resource_offset(&sys->resources, &pcie->pio, sys->io_offset);
++ err = pci_remap_iospace(&pcie->pio, pcie->io.start);
++ if (!err)
++ pci_add_resource_offset(&sys->resources, &pcie->pio,
++ sys->io_offset);
++
+ pci_add_resource_offset(&sys->resources, &pcie->mem, sys->mem_offset);
+ pci_add_resource_offset(&sys->resources, &pcie->prefetch,
+ sys->mem_offset);
+@@ -631,7 +635,6 @@ static int tegra_pcie_setup(int nr, stru
+ if (err < 0)
+ return err;
+
+- pci_remap_iospace(&pcie->pio, pcie->io.start);
+ return 1;
+ }
+
--- /dev/null
+From 53f4f7ee28076a36e427274d7d5c33b23dfc6221 Mon Sep 17 00:00:00 2001
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Date: Mon, 15 Aug 2016 17:50:43 +0100
+Subject: PCI: versatile: Fix pci_remap_iospace() failure path
+
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+
+commit 53f4f7ee28076a36e427274d7d5c33b23dfc6221 upstream.
+
+On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped
+IO, by reserving a chunk of virtual address space starting at PCI_IOBASE
+and by mapping the PCI host bridges memory address space driving PCI IO
+cycles to it.
+
+PCI host bridge drivers that enable downstream PCI IO cycles map the host
+bridge memory address responding to PCI IO cycles to the fixed virtual
+address space through the pci_remap_iospace() API.
+
+This means that if the pci_remap_iospace() function fails, the
+corresponding host bridge PCI IO resource must be considered invalid, in
+that there is no way for the kernel to actually drive PCI IO transactions
+if the memory addresses responding to PCI IO cycles cannot be mapped into
+the CPU virtual address space.
+
+The PCI versatile host bridge driver does not remove the PCI IO resource
+from the host bridge resource windows if the pci_remap_iospace() call
+fails; this is an actual bug in that the PCI host bridge would consider the
+PCI IO resource valid (and possibly assign it to downstream devices) even
+if the kernel was not able to map the PCI host bridge memory address
+driving IO cycle to the CPU virtual address space (ie pci_remap_iospace()
+failures).
+
+Fix the PCI host bridge driver pci_remap_iospace() failure path, by
+destroying the PCI host bridge PCI IO resources retrieved through firmware
+when the pci_remap_iospace() function call fails, therefore preventing the
+kernel from adding the respective PCI IO resource to the list of PCI host
+bridge valid resources, fixing the issue.
+
+Fixes: b7e78170efd4 ("PCI: versatile: Add DT-based ARM Versatile PB PCIe host driver")
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pci-versatile.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/host/pci-versatile.c
++++ b/drivers/pci/host/pci-versatile.c
+@@ -74,7 +74,7 @@ static int versatile_pci_parse_request_o
+ int err, mem = 1, res_valid = 0;
+ struct device_node *np = dev->of_node;
+ resource_size_t iobase;
+- struct resource_entry *win;
++ struct resource_entry *win, *tmp;
+
+ err = of_pci_get_host_bridge_resources(np, 0, 0xff, res, &iobase);
+ if (err)
+@@ -84,15 +84,17 @@ static int versatile_pci_parse_request_o
+ if (err)
+ goto out_release_res;
+
+- resource_list_for_each_entry(win, res) {
++ resource_list_for_each_entry_safe(win, tmp, res) {
+ struct resource *res = win->res;
+
+ switch (resource_type(res)) {
+ case IORESOURCE_IO:
+ err = pci_remap_iospace(res, iobase);
+- if (err)
++ if (err) {
+ dev_warn(dev, "error %d: failed to map resource %pR\n",
+ err, res);
++ resource_list_destroy_entry(win);
++ }
+ break;
+ case IORESOURCE_MEM:
+ res_valid |= !(res->flags & IORESOURCE_PREFETCH);
--- /dev/null
+From f2c8852e6e990fcab0d9e68de9d86e5fbea0b5dc Mon Sep 17 00:00:00 2001
+From: Wang Nan <wangnan0@huawei.com>
+Date: Wed, 28 Sep 2016 03:58:46 +0000
+Subject: perf data: Fix building in 32 bit platform with libbabeltrace
+
+From: Wang Nan <wangnan0@huawei.com>
+
+commit f2c8852e6e990fcab0d9e68de9d86e5fbea0b5dc upstream.
+
+On ARM32 building it report following error when we build with
+libbabeltrace:
+
+ util/data-convert-bt.c: In function 'add_bpf_output_values':
+ util/data-convert-bt.c:440:3: error: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'unsigned int' [-Werror=format]
+ cc1: all warnings being treated as errors
+
+Fix it by changing %lu to %zu.
+
+Signed-off-by: Wang Nan <wangnan0@huawei.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Zefan Li <lizefan@huawei.com>
+Cc: pi3orama@163.com
+Fixes: 6122d57e9f7c ("perf data: Support converting data from bpf_perf_event_output()")
+Link: http://lkml.kernel.org/r/1475035126-146587-1-git-send-email-wangnan0@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/data-convert-bt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/util/data-convert-bt.c
++++ b/tools/perf/util/data-convert-bt.c
+@@ -437,7 +437,7 @@ add_bpf_output_values(struct bt_ctf_even
+ int ret;
+
+ if (nr_elements * sizeof(u32) != raw_size)
+- pr_warning("Incorrect raw_size (%u) in bpf output event, skip %lu bytes\n",
++ pr_warning("Incorrect raw_size (%u) in bpf output event, skip %zu bytes\n",
+ raw_size, nr_elements * sizeof(u32) - raw_size);
+
+ len_type = bt_ctf_event_class_get_field_by_name(event_class, "raw_len");
--- /dev/null
+From d9ea48bc4e7cc297ca1073fa3f90ed80d964b7b4 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Mon, 12 Sep 2016 15:19:52 +0900
+Subject: perf hists browser: Fix event group display
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+commit d9ea48bc4e7cc297ca1073fa3f90ed80d964b7b4 upstream.
+
+Milian reported that the event group on TUI shows duplicated overhead.
+This was due to a bug on calculating hpp->buf position. The
+hpp_advance() was called from __hpp__slsmg_color_printf() on TUI but
+it's already called from the hpp__call_print_fn macro in __hpp__fmt().
+The end result is that the print function returns number of bytes it
+printed but the buffer advanced twice of the length.
+
+This is generally not a problem since it doesn't need to access the
+buffer again. But with event group, overhead needs to be printed
+multiple times and hist_entry__snprintf_alignment() tries to fill the
+space with buffer after it printed. So it (brokenly) showed the last
+overhead again.
+
+The bug was there from the beginning, but I think it's only revealed
+when the alignment function was added.
+
+Reported-by: Milian Wolff <milian.wolff@kdab.com>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Fixes: 89fee7094323 ("perf hists: Do column alignment on the format iterator")
+Link: http://lkml.kernel.org/r/20160912061958.16656-2-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/ui/browsers/hists.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -1091,7 +1091,6 @@ static int __hpp__slsmg_color_printf(str
+ ret = scnprintf(hpp->buf, hpp->size, fmt, len, percent);
+ ui_browser__printf(arg->b, "%s", hpp->buf);
+
+- advance_hpp(hpp, ret);
+ return ret;
+ }
+
--- /dev/null
+From 25b8592e912f085ce2ff736a2927584ddeab238c Mon Sep 17 00:00:00 2001
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Date: Wed, 31 Aug 2016 13:33:11 +0530
+Subject: perf powerpc: Fix build-test failure
+
+From: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+
+commit 25b8592e912f085ce2ff736a2927584ddeab238c upstream.
+
+'make -C tools/perf build-test' is failing with below log for poewrpc.
+
+ In file included from /tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf.h:15:0,
+ from util/cpumap.h:8,
+ from util/env.c:1:
+ /tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf-sys.h:23:56:
+ fatal error: ../../arch/powerpc/include/uapi/asm/unistd.h: No such file or directory
+ compilation terminated.
+
+I bisected it and found it's failing from commit ad430729ae00 ("Remove:
+kernel unistd*h files from perf's MANIFEST, not used").
+
+Header file '../../arch/powerpc/include/uapi/asm/unistd.h' is included
+only for powerpc in tools/perf/perf-sys.h.
+
+By looking closly at commit history, I found little weird thing:
+
+Commit f2d9cae9ea9e ("perf powerpc: Use uapi/unistd.h to fix build
+error") replaced 'asm/unistd.h' with 'uapi/asm/unistd.h'
+
+Commit d2709c7ce4c5 ("perf: Make perf build for x86 with UAPI
+disintegration applied") removes all arch specific 'uapi/asm/unistd.h'
+for all archs and adds generic <asm/unistd.h>.
+
+Commit f0b9abfb0446 ("Merge branch 'linus' into perf/core") again
+includes 'uapi/asm/unistd.h' for powerpc. Don't know how exactly this
+happened as this change is not part of commit also.
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/1472630591-5089-1-git-send-email-ravi.bangoria@linux.vnet.ibm.com
+Fixes: ad430729ae00 ("Remove: kernel unistd*h files from perf's MANIFEST, not used")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/perf-sys.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/tools/perf/perf-sys.h
++++ b/tools/perf/perf-sys.h
+@@ -20,7 +20,6 @@
+ #endif
+
+ #ifdef __powerpc__
+-#include "../../arch/powerpc/include/uapi/asm/unistd.h"
+ #define CPUINFO_PROC {"cpu"}
+ #endif
+
--- /dev/null
+From c97b40e4d15f13a36cd037d598e45cbe9e1e5757 Mon Sep 17 00:00:00 2001
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Thu, 1 Sep 2016 10:56:06 -0300
+Subject: perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+commit c97b40e4d15f13a36cd037d598e45cbe9e1e5757 upstream.
+
+We can allow aliases to be kept, but we were checking this just when
+loading vmlinux files, be consistent, do it for any symbol table loading
+code that calls symbol__fixup_duplicate() by making this function check
+.allow_aliases instead.
+
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Fixes: 680d926a8cb0 ("perf symbols: Allow symbol alias when loading map for symbol name")
+Link: http://lkml.kernel.org/n/tip-z0avp0s6cfjckc4xj3pdfjdz@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/symbol-elf.c | 3 +--
+ tools/perf/util/symbol.c | 3 +++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1113,8 +1113,7 @@ new_symbol:
+ * For misannotated, zeroed, ASM function sizes.
+ */
+ if (nr > 0) {
+- if (!symbol_conf.allow_aliases)
+- symbols__fixup_duplicate(&dso->symbols[map->type]);
++ symbols__fixup_duplicate(&dso->symbols[map->type]);
+ symbols__fixup_end(&dso->symbols[map->type]);
+ if (kmap) {
+ /*
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -152,6 +152,9 @@ void symbols__fixup_duplicate(struct rb_
+ struct rb_node *nd;
+ struct symbol *curr, *next;
+
++ if (symbol_conf.allow_aliases)
++ return;
++
+ nd = rb_first(symbols);
+
+ while (nd) {
--- /dev/null
+From 432746f8e0b6a82ba832b771afe31abd51af6752 Mon Sep 17 00:00:00 2001
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Thu, 1 Sep 2016 11:00:23 -0300
+Subject: perf symbols: Fixup symbol sizes before picking best ones
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+commit 432746f8e0b6a82ba832b771afe31abd51af6752 upstream.
+
+When we call symbol__fixup_duplicate() we use algorithms to pick the
+"best" symbols for cases where there are various functions/aliases to an
+address, and those check zero size symbols, which, before calling
+symbol__fixup_end() are _all_ symbols in a just parsed kallsyms file.
+
+So first fixup the end, then fixup the duplicates.
+
+Found while trying to figure out why 'perf test vmlinux' failed, see the
+output of 'perf test -v vmlinux' to see cases where the symbols picked
+as best for vmlinux don't match the ones picked for kallsyms.
+
+Cc: Anton Blanchard <anton@samba.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Wang Nan <wangnan0@huawei.com>
+Fixes: 694bf407b061 ("perf symbols: Add some heuristics for choosing the best duplicate symbol")
+Link: http://lkml.kernel.org/n/tip-rxqvdgr0mqjdxee0kf8i2ufn@git.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/symbol-elf.c | 2 +-
+ tools/perf/util/symbol.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1113,8 +1113,8 @@ new_symbol:
+ * For misannotated, zeroed, ASM function sizes.
+ */
+ if (nr > 0) {
+- symbols__fixup_duplicate(&dso->symbols[map->type]);
+ symbols__fixup_end(&dso->symbols[map->type]);
++ symbols__fixup_duplicate(&dso->symbols[map->type]);
+ if (kmap) {
+ /*
+ * We need to fixup this here too because we create new
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -1237,8 +1237,8 @@ int __dso__load_kallsyms(struct dso *dso
+ if (kallsyms__delta(map, filename, &delta))
+ return -1;
+
+- symbols__fixup_duplicate(&dso->symbols[map->type]);
+ symbols__fixup_end(&dso->symbols[map->type]);
++ symbols__fixup_duplicate(&dso->symbols[map->type]);
+
+ if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
+ dso->symtab_type = DSO_BINARY_TYPE__GUEST_KALLSYMS;
--- /dev/null
+From 9a6ad25b5a2026ba1399abc879ec623957867e79 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Tue, 13 Sep 2016 16:45:49 +0900
+Subject: perf ui/stdio: Always reset output width for hierarchy
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+commit 9a6ad25b5a2026ba1399abc879ec623957867e79 upstream.
+
+When the --hierarchy option is used, each entry has its own hpp_list to
+show the result. But it is not updating the width of each column for
+perf-top. The perf-report command has no problem since it resets it
+during header display.
+
+ $ sudo perf top --hierarchy --stdio
+
+ PerfTop: 160 irqs/sec kernel:38.8% exact: 100.0%
+ [4000Hz cycles:pp], (all, 12 CPUs)
+ ----------------------------------------------------------------------
+
+ 52.32% perf
+ 24.74% [.] __symbols__insert
+ 5.62% [.] rb_next
+ 5.14% [.] dso__load_sym
+
+Move the code into hists__fprintf() so that it can be called always.
+Also it'd be better to put similar code together.
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Fixes: 1b2dbbf41a0f ("perf hists: Use own hpp_list for hierarchy mode")
+Link: http://lkml.kernel.org/r/20160913074552.13284-5-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/ui/stdio/hist.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+--- a/tools/perf/ui/stdio/hist.c
++++ b/tools/perf/ui/stdio/hist.c
+@@ -628,14 +628,6 @@ hists__fprintf_hierarchy_headers(struct
+ struct perf_hpp *hpp,
+ FILE *fp)
+ {
+- struct perf_hpp_list_node *fmt_node;
+- struct perf_hpp_fmt *fmt;
+-
+- list_for_each_entry(fmt_node, &hists->hpp_formats, list) {
+- perf_hpp_list__for_each_format(&fmt_node->hpp, fmt)
+- perf_hpp__reset_width(fmt, hists);
+- }
+-
+ return print_hierarchy_header(hists, hpp, symbol_conf.field_sep, fp);
+ }
+
+@@ -714,6 +706,7 @@ size_t hists__fprintf(struct hists *hist
+ bool use_callchain)
+ {
+ struct perf_hpp_fmt *fmt;
++ struct perf_hpp_list_node *node;
+ struct rb_node *nd;
+ size_t ret = 0;
+ const char *sep = symbol_conf.field_sep;
+@@ -726,6 +719,11 @@ size_t hists__fprintf(struct hists *hist
+
+ hists__for_each_format(hists, fmt)
+ perf_hpp__reset_width(fmt, hists);
++ /* hierarchy entries have their own hpp list */
++ list_for_each_entry(node, &hists->hpp_formats, list) {
++ perf_hpp_list__for_each_format(&node->hpp, fmt)
++ perf_hpp__reset_width(fmt, hists);
++ }
+
+ if (symbol_conf.col_width_list_str)
+ perf_hpp__set_user_width(symbol_conf.col_width_list_str);
--- /dev/null
+From 5ff3e7a224d40f9dd73625b91377787034a8b35e Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Tue, 20 Sep 2016 14:30:23 +0900
+Subject: perf ui/tui: Reset output width for hierarchy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+commit 5ff3e7a224d40f9dd73625b91377787034a8b35e upstream.
+
+When --hierarchy option is used, each entry has its own hpp_list to show
+the result. But it missed to update width of each column.
+
+Before:
+
+ - 46.29% 48.12% netctl-auto
+ + 31.44% 29.25% [kernel.vmlinux]
+ + 8.52% 11.55% libc-2.22.so
+ + 5.19% 6.91% bash
+ + 10.75% 11.83% wpa_cli
+ + 8.25% 2.23% swapper
+ + 6.45% 5.40% tr
+ + 4.81% 8.09% awk
+ + 4.15% 2.85% firefox
+ + 3.86% 2.53% sh
+
+After:
+
+ - 46.29% 48.12% netctl-auto
+ + 31.44% 29.25% [kernel.vmlinux]
+ + 8.52% 11.55% libc-2.22.so
+ + 5.19% 6.91% bash
+ + 10.75% 11.83% wpa_cli
+ + 8.25% 2.23% swapper
+ + 6.45% 5.40% tr
+ + 4.81% 8.09% awk
+ + 4.15% 2.85% firefox
+ + 3.86% 2.53% sh
+
+Committer note:
+
+Full testing instructions:
+
+1) Record with an event group:
+
+ $ perf record -e '{cycles,instructions}' make -j4
+
+2) Use report in hierarchy mode, to get a few expanded trees on
+ the same screen, use --percent-limit:
+
+ $ perf report --hierarchy --percent-limit 0.5
+
+Samples: 103K of event 'anon group { cycles:u, instructions:u }',
+Event count (approx.): 57317631725
+ Overhead Command / Shared Object / Symbol â—†
+- 58.89% 55.12% cc1 â–’
+ - 50.26% 48.10% cc1 â–’
+ 3.61% 5.13% [.] _cpp_lex_token â–’
+ 2.58% 0.78% [.] ht_lookup_with_hash â–’
+ 1.31% 1.30% [.] ggc_internal_alloc â–’
+ 1.08% 2.25% [.] get_combined_adhoc_loc â–’
+ 1.01% 1.95% [.] ira_init â–’
+ 0.96% 1.78% [.] linemap_position_for_column â–’
+ 0.65% 1.01% [.] cpp_get_token_with_location â–’
+ - 7.52% 6.58% libc-2.23.so â–’
+ 1.70% 1.78% [.] _int_malloc â–’
+ 0.69% 0.75% [.] _int_free â–’
+ 0.67% 0.42% [.] malloc_consolidate â–’
+ - 0.58% 0.42% ld-2.23.so â–’
+ no entry >= 0.50% â–’
+ - 0.52% 0.03% [kernel.vmlinux] â–’
+ no entry >= 0.50% â–’
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Fixes: 1b2dbbf41a0f ("perf hists: Use own hpp_list for hierarchy mode")
+Link: http://lkml.kernel.org/r/20160920053025.13989-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/ui/browsers/hists.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -2045,6 +2045,7 @@ void hist_browser__init(struct hist_brow
+ struct hists *hists)
+ {
+ struct perf_hpp_fmt *fmt;
++ struct perf_hpp_list_node *node;
+
+ browser->hists = hists;
+ browser->b.refresh = hist_browser__refresh;
+@@ -2057,6 +2058,11 @@ void hist_browser__init(struct hist_brow
+ perf_hpp__reset_width(fmt, hists);
+ ++browser->b.columns;
+ }
++ /* hierarchy entries have their own hpp list */
++ list_for_each_entry(node, &hists->hpp_formats, list) {
++ perf_hpp_list__for_each_format(&node->hpp, fmt)
++ perf_hpp__reset_width(fmt, hists);
++ }
+ }
+
+ struct hist_browser *hist_browser__new(struct hists *hists)
--- /dev/null
+From 6bcf3f63394b9c4f133e4499349d786d7f531473 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Mon, 12 Sep 2016 11:36:55 +0200
+Subject: pinctrl: qcom: fix masking of pinmux functions
+
+From: John Crispin <john@phrozen.org>
+
+commit 6bcf3f63394b9c4f133e4499349d786d7f531473 upstream.
+
+The following commit introduced a regression by not properly masking the
+calculated value.
+
+Fixes: 47a01ee9a6c3 ("pinctrl: qcom: Clear all function selection bits")
+Signed-off-by: John Crispin <john@phrozen.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reviewed-by: Stephen Boyd <stephen.boyd@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/qcom/pinctrl-msm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-msm.c
++++ b/drivers/pinctrl/qcom/pinctrl-msm.c
+@@ -156,7 +156,7 @@ static int msm_pinmux_set_mux(struct pin
+ spin_lock_irqsave(&pctrl->lock, flags);
+
+ val = readl(pctrl->regs + g->ctl_reg);
+- val &= mask;
++ val &= ~mask;
+ val |= i << g->mux_bit;
+ writel(val, pctrl->regs + g->ctl_reg);
+
--- /dev/null
+From b0f16b46988fde02a1e32078f66a3059d7e53bfc Mon Sep 17 00:00:00 2001
+From: Cyril Bur <cyrilbur@gmail.com>
+Date: Fri, 23 Sep 2016 16:18:09 +1000
+Subject: powerpc: Add check_if_tm_restore_required() to giveup_all()
+
+From: Cyril Bur <cyrilbur@gmail.com>
+
+commit b0f16b46988fde02a1e32078f66a3059d7e53bfc upstream.
+
+giveup_all() causes FPU/VMX/VSX facilities to be disabled in a threads
+MSR. If the thread performing the giveup was transactional, the kernel
+must record which facilities were in use before the giveup as the
+thread must have these facilities re-enabled on return to userspace.
+
+>From process.c:
+ /*
+ * This is called if we are on the way out to userspace and the
+ * TIF_RESTORE_TM flag is set. It checks if we need to reload
+ * FP and/or vector state and does so if necessary.
+ * If userspace is inside a transaction (whether active or
+ * suspended) and FP/VMX/VSX instructions have ever been enabled
+ * inside that transaction, then we have to keep them enabled
+ * and keep the FP/VMX/VSX state loaded while ever the transaction
+ * continues. The reason is that if we didn't, and subsequently
+ * got a FP/VMX/VSX unavailable interrupt inside a transaction,
+ * we don't know whether it's the same transaction, and thus we
+ * don't know which of the checkpointed state and the transactional
+ * state to use.
+ */
+
+Calling check_if_tm_restore_required() will set TIF_RESTORE_TM and
+save the MSR if needed.
+
+Fixes: c208505 ("powerpc: create giveup_all()")
+Signed-off-by: Cyril Bur <cyrilbur@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/process.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -445,6 +445,7 @@ void giveup_all(struct task_struct *tsk)
+ return;
+
+ msr_check_and_set(msr_all_available);
++ check_if_tm_restore_required(tsk);
+
+ #ifdef CONFIG_PPC_FPU
+ if (usermsr & MSR_FP)
--- /dev/null
+From dc16b553c949e81f37555777dc7bab66d78285a7 Mon Sep 17 00:00:00 2001
+From: Cyril Bur <cyrilbur@gmail.com>
+Date: Fri, 23 Sep 2016 16:18:08 +1000
+Subject: powerpc: Always restore FPU/VEC/VSX if hardware transactional memory in use
+
+From: Cyril Bur <cyrilbur@gmail.com>
+
+commit dc16b553c949e81f37555777dc7bab66d78285a7 upstream.
+
+Comment from arch/powerpc/kernel/process.c:967:
+ If userspace is inside a transaction (whether active or
+ suspended) and FP/VMX/VSX instructions have ever been enabled
+ inside that transaction, then we have to keep them enabled
+ and keep the FP/VMX/VSX state loaded while ever the transaction
+ continues. The reason is that if we didn't, and subsequently
+ got a FP/VMX/VSX unavailable interrupt inside a transaction,
+ we don't know whether it's the same transaction, and thus we
+ don't know which of the checkpointed state and the ransactional
+ state to use.
+
+restore_math() restore_fp() and restore_altivec() currently may not
+restore the registers. It doesn't appear that this is more serious
+than a performance penalty. If the math registers aren't restored the
+userspace thread will still be run with the facility disabled.
+Userspace will not be able to read invalid values. On the first access
+it will take an facility unavailable exception and the kernel will
+detected an active transaction, at which point it will abort the
+transaction. There is the possibility for a pathological case
+preventing any progress by transactions, however, transactions
+are never guaranteed to make progress.
+
+Fixes: 70fe3d9 ("powerpc: Restore FPU/VEC/VSX if previously used")
+Signed-off-by: Cyril Bur <cyrilbur@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/process.c | 21 ++++++++++++++++++---
+ 1 file changed, 18 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -88,7 +88,13 @@ static void check_if_tm_restore_required
+ set_thread_flag(TIF_RESTORE_TM);
+ }
+ }
++
++static inline bool msr_tm_active(unsigned long msr)
++{
++ return MSR_TM_ACTIVE(msr);
++}
+ #else
++static inline bool msr_tm_active(unsigned long msr) { return false; }
+ static inline void check_if_tm_restore_required(struct task_struct *tsk) { }
+ #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
+
+@@ -208,7 +214,7 @@ void enable_kernel_fp(void)
+ EXPORT_SYMBOL(enable_kernel_fp);
+
+ static int restore_fp(struct task_struct *tsk) {
+- if (tsk->thread.load_fp) {
++ if (tsk->thread.load_fp || msr_tm_active(tsk->thread.regs->msr)) {
+ load_fp_state(¤t->thread.fp_state);
+ current->thread.load_fp++;
+ return 1;
+@@ -278,7 +284,8 @@ EXPORT_SYMBOL_GPL(flush_altivec_to_threa
+
+ static int restore_altivec(struct task_struct *tsk)
+ {
+- if (cpu_has_feature(CPU_FTR_ALTIVEC) && tsk->thread.load_vec) {
++ if (cpu_has_feature(CPU_FTR_ALTIVEC) &&
++ (tsk->thread.load_vec || msr_tm_active(tsk->thread.regs->msr))) {
+ load_vr_state(&tsk->thread.vr_state);
+ tsk->thread.used_vr = 1;
+ tsk->thread.load_vec++;
+@@ -464,7 +471,8 @@ void restore_math(struct pt_regs *regs)
+ {
+ unsigned long msr;
+
+- if (!current->thread.load_fp && !loadvec(current->thread))
++ if (!msr_tm_active(regs->msr) &&
++ !current->thread.load_fp && !loadvec(current->thread))
+ return;
+
+ msr = regs->msr;
+@@ -983,6 +991,13 @@ void restore_tm_state(struct pt_regs *re
+ msr_diff = current->thread.ckpt_regs.msr & ~regs->msr;
+ msr_diff &= MSR_FP | MSR_VEC | MSR_VSX;
+
++ /* Ensure that restore_math() will restore */
++ if (msr_diff & MSR_FP)
++ current->thread.load_fp = 1;
++#ifdef CONFIG_ALIVEC
++ if (cpu_has_feature(CPU_FTR_ALTIVEC) && msr_diff & MSR_VEC)
++ current->thread.load_vec = 1;
++#endif
+ restore_math(regs);
+
+ regs->msr |= msr_diff;
--- /dev/null
+From 6b8cb66a6a7cc182b47da6a0a1d4e5da324c0695 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Mon, 19 Sep 2016 12:58:54 +0200
+Subject: powerpc: Fix usage of _PAGE_RO in hugepage
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit 6b8cb66a6a7cc182b47da6a0a1d4e5da324c0695 upstream.
+
+On some CPUs like the 8xx, _PAGE_RW hence _PAGE_WRITE is defined
+as 0 and _PAGE_RO has to be set when a page is not writable
+
+_PAGE_RO is defined by default in pte-common.h, however BOOK3S/64
+doesn't include that file so _PAGE_RO has to be defined explicitly
+in book3s/64/pgtable.h
+
+Fixes: a7b9f671f2d14 ("powerpc32: adds handling of _PAGE_RO")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/book3s/64/pgtable.h | 2 ++
+ arch/powerpc/mm/hugetlbpage.c | 7 +++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/powerpc/include/asm/book3s/64/pgtable.h
++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h
+@@ -6,6 +6,8 @@
+ */
+ #define _PAGE_BIT_SWAP_TYPE 0
+
++#define _PAGE_RO 0
++
+ #define _PAGE_EXEC 0x00001 /* execute permission */
+ #define _PAGE_WRITE 0x00002 /* write access allowed */
+ #define _PAGE_READ 0x00004 /* read access allowed */
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -1019,8 +1019,15 @@ int gup_hugepte(pte_t *ptep, unsigned lo
+
+ pte = READ_ONCE(*ptep);
+ mask = _PAGE_PRESENT | _PAGE_READ;
++
++ /*
++ * On some CPUs like the 8xx, _PAGE_RW hence _PAGE_WRITE is defined
++ * as 0 and _PAGE_RO has to be set when a page is not writable
++ */
+ if (write)
+ mask |= _PAGE_WRITE;
++ else
++ mask |= _PAGE_RO;
+
+ if ((pte_val(pte) & mask) != mask)
+ return 0;
--- /dev/null
+From 11b7e154b132232535befe51c55db048069c8461 Mon Sep 17 00:00:00 2001
+From: Pan Xinhui <xinhui.pan@linux.vnet.ibm.com>
+Date: Thu, 10 Dec 2015 15:30:02 +0800
+Subject: powerpc/nvram: Fix an incorrect partition merge
+
+From: Pan Xinhui <xinhui.pan@linux.vnet.ibm.com>
+
+commit 11b7e154b132232535befe51c55db048069c8461 upstream.
+
+When we merge two contiguous partitions whose signatures are marked
+NVRAM_SIG_FREE, We need update prev's length and checksum, then write it
+to nvram, not cur's. So lets fix this mistake now.
+
+Also use memset instead of strncpy to set the partition's name. It's
+more readable if we want to fill up with duplicate chars .
+
+Fixes: fa2b4e54d41f ("powerpc/nvram: Improve partition removal")
+Signed-off-by: Pan Xinhui <xinhui.pan@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/nvram_64.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/kernel/nvram_64.c
++++ b/arch/powerpc/kernel/nvram_64.c
+@@ -956,7 +956,7 @@ int __init nvram_remove_partition(const
+
+ /* Make partition a free partition */
+ part->header.signature = NVRAM_SIG_FREE;
+- strncpy(part->header.name, "wwwwwwwwwwww", 12);
++ memset(part->header.name, 'w', 12);
+ part->header.checksum = nvram_checksum(&part->header);
+ rc = nvram_write_header(part);
+ if (rc <= 0) {
+@@ -974,8 +974,8 @@ int __init nvram_remove_partition(const
+ }
+ if (prev) {
+ prev->header.length += part->header.length;
+- prev->header.checksum = nvram_checksum(&part->header);
+- rc = nvram_write_header(part);
++ prev->header.checksum = nvram_checksum(&prev->header);
++ rc = nvram_write_header(prev);
+ if (rc <= 0) {
+ printk(KERN_ERR "nvram_remove_partition: nvram_write failed (%d)\n", rc);
+ return rc;
--- /dev/null
+From d53c51f26145657aa7c55fa396f93677e613548d Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Date: Wed, 28 Sep 2016 13:36:19 +0200
+Subject: s390/cio: fix accidental interrupt enabling during resume
+
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+
+commit d53c51f26145657aa7c55fa396f93677e613548d upstream.
+
+Since commit 9f3d6d7 chsc_get_channel_measurement_chars is called with
+interrupts disabled during resume from hibernate. Since this function
+used spin_unlock_irq, interrupts have been enabled accidentally. Fix
+this by using the irqsave variant.
+
+Since we can't guarantee the IRQ-enablement state for all (future/
+external) callers, change the locking in related functions to prevent
+similar bugs in the future.
+
+Fixes: 9f3d6d7 ("s390/cio: update measurement characteristics")
+Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/cio/chsc.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/s390/cio/chsc.c
++++ b/drivers/s390/cio/chsc.c
+@@ -95,12 +95,13 @@ struct chsc_ssd_area {
+ int chsc_get_ssd_info(struct subchannel_id schid, struct chsc_ssd_info *ssd)
+ {
+ struct chsc_ssd_area *ssd_area;
++ unsigned long flags;
+ int ccode;
+ int ret;
+ int i;
+ int mask;
+
+- spin_lock_irq(&chsc_page_lock);
++ spin_lock_irqsave(&chsc_page_lock, flags);
+ memset(chsc_page, 0, PAGE_SIZE);
+ ssd_area = chsc_page;
+ ssd_area->request.length = 0x0010;
+@@ -144,7 +145,7 @@ int chsc_get_ssd_info(struct subchannel_
+ ssd->fla[i] = ssd_area->fla[i];
+ }
+ out:
+- spin_unlock_irq(&chsc_page_lock);
++ spin_unlock_irqrestore(&chsc_page_lock, flags);
+ return ret;
+ }
+
+@@ -832,9 +833,10 @@ int __chsc_do_secm(struct channel_subsys
+ u32 fmt : 4;
+ u32 : 16;
+ } __attribute__ ((packed)) *secm_area;
++ unsigned long flags;
+ int ret, ccode;
+
+- spin_lock_irq(&chsc_page_lock);
++ spin_lock_irqsave(&chsc_page_lock, flags);
+ memset(chsc_page, 0, PAGE_SIZE);
+ secm_area = chsc_page;
+ secm_area->request.length = 0x0050;
+@@ -864,7 +866,7 @@ int __chsc_do_secm(struct channel_subsys
+ CIO_CRW_EVENT(2, "chsc: secm failed (rc=%04x)\n",
+ secm_area->response.code);
+ out:
+- spin_unlock_irq(&chsc_page_lock);
++ spin_unlock_irqrestore(&chsc_page_lock, flags);
+ return ret;
+ }
+
+@@ -992,6 +994,7 @@ chsc_initialize_cmg_chars(struct channel
+
+ int chsc_get_channel_measurement_chars(struct channel_path *chp)
+ {
++ unsigned long flags;
+ int ccode, ret;
+
+ struct {
+@@ -1021,7 +1024,7 @@ int chsc_get_channel_measurement_chars(s
+ if (!css_chsc_characteristics.scmc || !css_chsc_characteristics.secm)
+ return -EINVAL;
+
+- spin_lock_irq(&chsc_page_lock);
++ spin_lock_irqsave(&chsc_page_lock, flags);
+ memset(chsc_page, 0, PAGE_SIZE);
+ scmc_area = chsc_page;
+ scmc_area->request.length = 0x0010;
+@@ -1053,7 +1056,7 @@ int chsc_get_channel_measurement_chars(s
+ chsc_initialize_cmg_chars(chp, scmc_area->cmcv,
+ (struct cmg_chars *) &scmc_area->data);
+ out:
+- spin_unlock_irq(&chsc_page_lock);
++ spin_unlock_irqrestore(&chsc_page_lock, flags);
+ return ret;
+ }
+
+@@ -1134,6 +1137,7 @@ struct css_chsc_char css_chsc_characteri
+ int __init
+ chsc_determine_css_characteristics(void)
+ {
++ unsigned long flags;
+ int result;
+ struct {
+ struct chsc_header request;
+@@ -1146,7 +1150,7 @@ chsc_determine_css_characteristics(void)
+ u32 chsc_char[508];
+ } __attribute__ ((packed)) *scsc_area;
+
+- spin_lock_irq(&chsc_page_lock);
++ spin_lock_irqsave(&chsc_page_lock, flags);
+ memset(chsc_page, 0, PAGE_SIZE);
+ scsc_area = chsc_page;
+ scsc_area->request.length = 0x0010;
+@@ -1168,7 +1172,7 @@ chsc_determine_css_characteristics(void)
+ CIO_CRW_EVENT(2, "chsc: scsc failed (rc=%04x)\n",
+ scsc_area->response.code);
+ exit:
+- spin_unlock_irq(&chsc_page_lock);
++ spin_unlock_irqrestore(&chsc_page_lock, flags);
+ return result;
+ }
+
--- /dev/null
+From 6cd997db911f28f2510b771691270c52b63ed2e6 Mon Sep 17 00:00:00 2001
+From: Sascha Silbe <silbe@linux.vnet.ibm.com>
+Date: Tue, 20 Sep 2016 19:09:07 +0200
+Subject: s390/con3270: fix insufficient space padding
+
+From: Sascha Silbe <silbe@linux.vnet.ibm.com>
+
+commit 6cd997db911f28f2510b771691270c52b63ed2e6 upstream.
+
+con3270 contains an optimisation that reduces the amount of data to be
+transmitted to the 3270 terminal by putting a Repeat to Address (RA)
+order into the data stream. The RA order itself takes up space, so
+con3270 only uses it if there's enough space left in the line
+buffer. Otherwise it just pads out the line manually.
+
+For lines that were _just_ short enough that the RA order still fit in
+the line buffer, the line was instead padded with an insufficient
+amount of spaces. This was caused by examining the size of the
+allocated line buffer rather than the length of the string to be
+displayed.
+
+For con3270_cline_end(), we just compare against the line length. For
+con3270_update_string() however that isn't available anymore, so we
+check whether the Repeat to Address order is present.
+
+Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git)
+Tested-by: Jing Liu <liujbjl@linux.vnet.ibm.com>
+Tested-by: Yang Chen <bjcyang@linux.vnet.ibm.com>
+Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/char/con3270.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/char/con3270.c
++++ b/drivers/s390/char/con3270.c
+@@ -124,7 +124,12 @@ con3270_create_status(struct con3270 *cp
+ static void
+ con3270_update_string(struct con3270 *cp, struct string *s, int nr)
+ {
+- if (s->len >= cp->view.cols - 5)
++ if (s->len < 4) {
++ /* This indicates a bug, but printing a warning would
++ * cause a deadlock. */
++ return;
++ }
++ if (s->string[s->len - 4] != TO_RA)
+ return;
+ raw3270_buffer_address(cp->view.dev, s->string + s->len - 3,
+ cp->view.cols * (nr + 1));
+@@ -460,7 +465,7 @@ con3270_cline_end(struct con3270 *cp)
+ cp->cline->len + 4 : cp->view.cols;
+ s = con3270_alloc_string(cp, size);
+ memcpy(s->string, cp->cline->string, cp->cline->len);
+- if (s->len < cp->view.cols - 5) {
++ if (cp->cline->len < cp->view.cols - 5) {
+ s->string[s->len - 4] = TO_RA;
+ s->string[s->len - 1] = 0;
+ } else {
--- /dev/null
+From c14f2aac7aa147861793eed9f41f91dd530f0be1 Mon Sep 17 00:00:00 2001
+From: Sascha Silbe <silbe@linux.vnet.ibm.com>
+Date: Thu, 11 Aug 2016 21:34:54 +0200
+Subject: s390/con3270: fix use of uninitialised data
+
+From: Sascha Silbe <silbe@linux.vnet.ibm.com>
+
+commit c14f2aac7aa147861793eed9f41f91dd530f0be1 upstream.
+
+con3270 contains an optimisation that reduces the amount of data to be
+transmitted to the 3270 terminal by putting a Repeat to Address (RA)
+order into the data stream. The RA order itself takes up space, so
+con3270 only uses it if there's enough space left in the line
+buffer. Otherwise it just pads out the line manually.
+
+For lines too long to include the RA order, one byte was left
+uninitialised. This was caused by an off-by-one bug in the loop that
+pads out the line. Since the buffer is allocated from a common pool,
+the single byte left uninitialised contained some previous buffer
+content. Usually this was just a space or some character (which can
+result in clutter but is otherwise harmless). Sometimes, however, it
+was a Repeat to Address order, messing up the entire screen layout and
+causing the display to send the entire buffer content on every
+keystroke.
+
+Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git)
+Reported-by: Liu Jing <liujbjl@linux.vnet.ibm.com>
+Tested-by: Jing Liu <liujbjl@linux.vnet.ibm.com>
+Tested-by: Yang Chen <bjcyang@linux.vnet.ibm.com>
+Signed-off-by: Sascha Silbe <silbe@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/char/con3270.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/s390/char/con3270.c
++++ b/drivers/s390/char/con3270.c
+@@ -464,7 +464,7 @@ con3270_cline_end(struct con3270 *cp)
+ s->string[s->len - 4] = TO_RA;
+ s->string[s->len - 1] = 0;
+ } else {
+- while (--size > cp->cline->len)
++ while (--size >= cp->cline->len)
+ s->string[size] = cp->view.ascebc[' '];
+ }
+ /* Replace cline with allocated line s and reset cline. */
dmaengine-ipu-remove-bogus-no_irq-reference.patch
mm-hugetlb-check-for-reserved-hugepages-during-memory-offline.patch
mm-hugetlb-improve-locking-in-dissolve_free_huge_pages.patch
+drm-vmwgfx-avoid-validating-views-on-view-destruction.patch
+s390-cio-fix-accidental-interrupt-enabling-during-resume.patch
+s390-con3270-fix-use-of-uninitialised-data.patch
+s390-con3270-fix-insufficient-space-padding.patch
+clk-bcm2835-skip-pllc-clocks-when-deciding-on-a-new-clock-parent.patch
+clk-gcc-msm8996-fix-pcie-2-pipe-register-offset.patch
+clk-qcom-select-gdsc-for-msm8996-gcc-and-mmcc.patch
+clk-qoriq-fix-a-register-offset-error.patch
+clk-return-errors-from-clk-providers-in-__of_clk_get_from_provider.patch
+clk-core-force-setting-the-phase-delay-when-no-change.patch
+clk-divider-fix-clk_divider_round_rate-to-use-clk_readl.patch
+perf-data-fix-building-in-32-bit-platform-with-libbabeltrace.patch
+perf-hists-browser-fix-event-group-display.patch
+perf-powerpc-fix-build-test-failure.patch
+perf-ui-tui-reset-output-width-for-hierarchy.patch
+perf-ui-stdio-always-reset-output-width-for-hierarchy.patch
+perf-symbols-check-symbol_conf.allow_aliases-for-kallsyms-loading-too.patch
+perf-symbols-fixup-symbol-sizes-before-picking-best-ones.patch
+iwlwifi-check-for-valid-ethernet-address-provided-by-oem.patch
+iwlwifi-mvm-fix-pending-frames-tracking-on-tx-resp.patch
+iwlwifi-mvm-call-a-different-txq_enable-function.patch
+iwlwifi-mvm-free-reserved-queue-on-sta-removal.patch
+iwlwifi-mvm-support-bar-in-reorder-buffer.patch
+iwlwifi-mvm-disable-p2p-queue-on-mac-context-release.patch
+iwlwifi-mvm-bail-out-if-ctdp-start-operation-fails.patch
+arm-dts-sun9i-add-missing-interrupt-cells-to-r_pio-pinctrl-device-node.patch
+pinctrl-qcom-fix-masking-of-pinmux-functions.patch
+mpt3sas-don-t-spam-logs-if-logging-level-is-0.patch
+powerpc-always-restore-fpu-vec-vsx-if-hardware-transactional-memory-in-use.patch
+powerpc-add-check_if_tm_restore_required-to-giveup_all.patch
+powerpc-nvram-fix-an-incorrect-partition-merge.patch
+powerpc-fix-usage-of-_page_ro-in-hugepage.patch
+arm-pxa-pxa_cplds-fix-interrupt-handling.patch
+arm-pxa-fix-gpio-double-shifts.patch
+arm-dts-nsp-correct-ram-amount-for-bcm958625hr-board.patch
+arm-dts-fix-realview-eb-smsc-ethernet-version.patch
+arm-dts-omap3-overo-add-missing-unit-name-for-lcd35-display.patch
+pci-rcar-fix-pci_remap_iospace-failure-path.patch
+pci-aardvark-fix-pci_remap_iospace-failure-path.patch
+pci-generic-fix-pci_remap_iospace-failure-path.patch
+pci-versatile-fix-pci_remap_iospace-failure-path.patch
+pci-designware-fix-pci_remap_iospace-failure-path.patch
+pci-tegra-fix-pci_remap_iospace-failure-path.patch
+libnvdimm-clear-the-internal-poison_list-when-clearing-badblocks.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
