--- /dev/null
+From 0628467f97b5227755428bac10a68257322f7e34 Mon Sep 17 00:00:00 2001
+From: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
+Date: Wed, 21 Sep 2016 16:28:06 +0530
+Subject: ath10k: fix copy engine 5 destination ring stuck
+
+From: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
+
+commit 0628467f97b5227755428bac10a68257322f7e34 upstream.
+
+Firmware is running watchdog timer for tracking copy engine ring index
+and write index. Whenever both indices are stuck at same location for
+given duration, watchdog will be trigger to assert target. While
+updating copy engine destination ring write index, driver ensures that
+write index will not be same as read index by finding delta between these
+two indices (CE_RING_DELTA).
+
+HTT target to host copy engine (CE5) is special case where ring buffers
+will be reused and delta check is not applied while updating write index.
+In rare scenario, whenever CE5 ring is full, both indices will be referring
+same location and this is causing CE ring stuck issue as explained
+above. This issue is originally reported on IPQ4019 during long hour stress
+testing and during veriwave max clients testsuites. The same issue is
+also observed in other chips as well. Fix this by ensuring that write
+index is one less than read index which means that full ring is
+available for receiving data.
+
+Tested-by: Tamizh chelvam <c_traja@qti.qualcomm.com>
+Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath10k/ce.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/ce.c
++++ b/drivers/net/wireless/ath/ath10k/ce.c
+@@ -433,6 +433,13 @@ void ath10k_ce_rx_update_write_idx(struc
+ unsigned int nentries_mask = dest_ring->nentries_mask;
+ unsigned int write_index = dest_ring->write_index;
+ u32 ctrl_addr = pipe->ctrl_addr;
++ u32 cur_write_idx = ath10k_ce_dest_ring_write_index_get(ar, ctrl_addr);
++
++ /* Prevent CE ring stuck issue that will occur when ring is full.
++ * Make sure that write index is 1 less than read index.
++ */
++ if ((cur_write_idx + nentries) == dest_ring->sw_index)
++ nentries -= 1;
+
+ write_index = CE_RING_IDX_ADD(nentries_mask, write_index, nentries);
+ ath10k_ce_dest_ring_write_index_set(ar, ctrl_addr, write_index);
--- /dev/null
+From b1d51b448e4e6a392283b3eab06a7c5ec6d8a4e2 Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Fri, 16 Sep 2016 11:16:10 +0200
+Subject: clk: imx6: fix i.MX6DL clock tree to reflect reality
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+commit b1d51b448e4e6a392283b3eab06a7c5ec6d8a4e2 upstream.
+
+The current clock tree only implements the minimal set of differences
+between the i.MX6Q and the i.MX6DL, but that doesn't really reflect
+reality.
+
+Apply the following fixes to match the RM:
+- DL has no GPU3D_SHADER_SEL/PODF, the shader domain is clocked by
+ GPU3D_CORE
+- GPU3D_SHADER_SEL/PODF has been repurposed as GPU2D_CORE_SEL/PODF
+- GPU2D_CORE_SEL/PODF has been repurposed as MLB_SEL/PODF
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/imx/clk-imx6q.c | 28 ++++++++++++++++------------
+ include/dt-bindings/clock/imx6qdl-clock.h | 4 +++-
+ 2 files changed, 19 insertions(+), 13 deletions(-)
+
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -318,11 +318,16 @@ static void __init imx6q_clocks_init(str
+ clk[IMX6QDL_CLK_IPG_PER_SEL] = imx_clk_mux("ipg_per_sel", base + 0x1c, 6, 1, ipg_per_sels, ARRAY_SIZE(ipg_per_sels));
+ clk[IMX6QDL_CLK_UART_SEL] = imx_clk_mux("uart_sel", base + 0x24, 6, 1, uart_sels, ARRAY_SIZE(uart_sels));
+ clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 16, 2, gpu2d_core_sels_2, ARRAY_SIZE(gpu2d_core_sels_2));
++ } else if (clk_on_imx6dl()) {
++ clk[IMX6QDL_CLK_MLB_SEL] = imx_clk_mux("mlb_sel", base + 0x18, 16, 2, gpu2d_core_sels, ARRAY_SIZE(gpu2d_core_sels));
+ } else {
+ clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 16, 2, gpu2d_core_sels, ARRAY_SIZE(gpu2d_core_sels));
+ }
+ clk[IMX6QDL_CLK_GPU3D_CORE_SEL] = imx_clk_mux("gpu3d_core_sel", base + 0x18, 4, 2, gpu3d_core_sels, ARRAY_SIZE(gpu3d_core_sels));
+- clk[IMX6QDL_CLK_GPU3D_SHADER_SEL] = imx_clk_mux("gpu3d_shader_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
++ if (clk_on_imx6dl())
++ clk[IMX6QDL_CLK_GPU2D_CORE_SEL] = imx_clk_mux("gpu2d_core_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
++ else
++ clk[IMX6QDL_CLK_GPU3D_SHADER_SEL] = imx_clk_mux("gpu3d_shader_sel", base + 0x18, 8, 2, gpu3d_shader_sels, ARRAY_SIZE(gpu3d_shader_sels));
+ clk[IMX6QDL_CLK_IPU1_SEL] = imx_clk_mux("ipu1_sel", base + 0x3c, 9, 2, ipu_sels, ARRAY_SIZE(ipu_sels));
+ clk[IMX6QDL_CLK_IPU2_SEL] = imx_clk_mux("ipu2_sel", base + 0x3c, 14, 2, ipu_sels, ARRAY_SIZE(ipu_sels));
+ clk[IMX6QDL_CLK_LDB_DI0_SEL] = imx_clk_mux_flags("ldb_di0_sel", base + 0x2c, 9, 3, ldb_di_sels, ARRAY_SIZE(ldb_di_sels), CLK_SET_RATE_PARENT);
+@@ -400,9 +405,15 @@ static void __init imx6q_clocks_init(str
+ clk[IMX6QDL_CLK_LDB_DI0_DIV_3_5] = imx_clk_fixed_factor("ldb_di0_div_3_5", "ldb_di0_sel", 2, 7);
+ clk[IMX6QDL_CLK_LDB_DI1_DIV_3_5] = imx_clk_fixed_factor("ldb_di1_div_3_5", "ldb_di1_sel", 2, 7);
+ }
+- clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 23, 3);
++ if (clk_on_imx6dl())
++ clk[IMX6QDL_CLK_MLB_PODF] = imx_clk_divider("mlb_podf", "mlb_sel", base + 0x18, 23, 3);
++ else
++ clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 23, 3);
+ clk[IMX6QDL_CLK_GPU3D_CORE_PODF] = imx_clk_divider("gpu3d_core_podf", "gpu3d_core_sel", base + 0x18, 26, 3);
+- clk[IMX6QDL_CLK_GPU3D_SHADER] = imx_clk_divider("gpu3d_shader", "gpu3d_shader_sel", base + 0x18, 29, 3);
++ if (clk_on_imx6dl())
++ clk[IMX6QDL_CLK_GPU2D_CORE_PODF] = imx_clk_divider("gpu2d_core_podf", "gpu2d_core_sel", base + 0x18, 29, 3);
++ else
++ clk[IMX6QDL_CLK_GPU3D_SHADER] = imx_clk_divider("gpu3d_shader", "gpu3d_shader_sel", base + 0x18, 29, 3);
+ clk[IMX6QDL_CLK_IPU1_PODF] = imx_clk_divider("ipu1_podf", "ipu1_sel", base + 0x3c, 11, 3);
+ clk[IMX6QDL_CLK_IPU2_PODF] = imx_clk_divider("ipu2_podf", "ipu2_sel", base + 0x3c, 16, 3);
+ clk[IMX6QDL_CLK_LDB_DI0_PODF] = imx_clk_divider_flags("ldb_di0_podf", "ldb_di0_div_3_5", base + 0x20, 10, 1, 0);
+@@ -473,14 +484,7 @@ static void __init imx6q_clocks_init(str
+ clk[IMX6QDL_CLK_ESAI_MEM] = imx_clk_gate2_shared("esai_mem", "ahb", base + 0x6c, 16, &share_count_esai);
+ clk[IMX6QDL_CLK_GPT_IPG] = imx_clk_gate2("gpt_ipg", "ipg", base + 0x6c, 20);
+ clk[IMX6QDL_CLK_GPT_IPG_PER] = imx_clk_gate2("gpt_ipg_per", "ipg_per", base + 0x6c, 22);
+- if (clk_on_imx6dl())
+- /*
+- * The multiplexer and divider of imx6q clock gpu3d_shader get
+- * redefined/reused as gpu2d_core_sel and gpu2d_core_podf on imx6dl.
+- */
+- clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu3d_shader", base + 0x6c, 24);
+- else
+- clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24);
++ clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24);
+ clk[IMX6QDL_CLK_GPU3D_CORE] = imx_clk_gate2("gpu3d_core", "gpu3d_core_podf", base + 0x6c, 26);
+ clk[IMX6QDL_CLK_HDMI_IAHB] = imx_clk_gate2("hdmi_iahb", "ahb", base + 0x70, 0);
+ clk[IMX6QDL_CLK_HDMI_ISFR] = imx_clk_gate2("hdmi_isfr", "video_27m", base + 0x70, 4);
+@@ -511,7 +515,7 @@ static void __init imx6q_clocks_init(str
+ * The multiplexer and divider of the imx6q clock gpu2d get
+ * redefined/reused as mlb_sys_sel and mlb_sys_clk_podf on imx6dl.
+ */
+- clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "gpu2d_core_podf", base + 0x74, 18);
++ clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "mlb_podf", base + 0x74, 18);
+ else
+ clk[IMX6QDL_CLK_MLB] = imx_clk_gate2("mlb", "axi", base + 0x74, 18);
+ clk[IMX6QDL_CLK_MMDC_CH0_AXI] = imx_clk_gate2("mmdc_ch0_axi", "mmdc_ch0_axi_podf", base + 0x74, 20);
+--- a/include/dt-bindings/clock/imx6qdl-clock.h
++++ b/include/dt-bindings/clock/imx6qdl-clock.h
+@@ -269,6 +269,8 @@
+ #define IMX6QDL_CLK_PRG0_APB 256
+ #define IMX6QDL_CLK_PRG1_APB 257
+ #define IMX6QDL_CLK_PRE_AXI 258
+-#define IMX6QDL_CLK_END 259
++#define IMX6QDL_CLK_MLB_SEL 259
++#define IMX6QDL_CLK_MLB_PODF 260
++#define IMX6QDL_CLK_END 261
+
+ #endif /* __DT_BINDINGS_CLOCK_IMX6QDL_H */
--- /dev/null
+From d8846023aed1293e54d33499558fc2aa2b2f393f Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Fri, 16 Sep 2016 11:16:11 +0200
+Subject: clk: imx6: initialize GPU clocks
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+commit d8846023aed1293e54d33499558fc2aa2b2f393f upstream.
+
+Initialize the GPU clock muxes to sane inputs. Until now they have
+not been changed from their default values, which means that both
+GPU3D shader and GPU2D core were fed by clock inputs whose rates
+exceed the maximium allowed frequency of the cores by as much as
+200MHz.
+
+This fixes a severe GPU stability issue on i.MX6DL.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/imx/clk-imx6q.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -629,6 +629,24 @@ static void __init imx6q_clocks_init(str
+ if (IS_ENABLED(CONFIG_PCI_IMX6))
+ clk_set_parent(clk[IMX6QDL_CLK_LVDS1_SEL], clk[IMX6QDL_CLK_SATA_REF_100M]);
+
++ /*
++ * Initialize the GPU clock muxes, so that the maximum specified clock
++ * rates for the respective SoC are not exceeded.
++ */
++ if (clk_on_imx6dl()) {
++ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_CORE_SEL],
++ clk[IMX6QDL_CLK_PLL2_PFD1_594M]);
++ clk_set_parent(clk[IMX6QDL_CLK_GPU2D_CORE_SEL],
++ clk[IMX6QDL_CLK_PLL2_PFD1_594M]);
++ } else if (clk_on_imx6q()) {
++ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_CORE_SEL],
++ clk[IMX6QDL_CLK_MMDC_CH0_AXI]);
++ clk_set_parent(clk[IMX6QDL_CLK_GPU3D_SHADER_SEL],
++ clk[IMX6QDL_CLK_PLL2_PFD1_594M]);
++ clk_set_parent(clk[IMX6QDL_CLK_GPU2D_CORE_SEL],
++ clk[IMX6QDL_CLK_PLL3_USB_OTG]);
++ }
++
+ imx_register_uart_clocks(uart_clks);
+ }
+ CLK_OF_DECLARE(imx6q, "fsl,imx6q-ccm", imx6q_clocks_init);
--- /dev/null
+From 2d4d5481e2d6f93b25fcfb13a9f20bbfbf54266a Mon Sep 17 00:00:00 2001
+From: Tomas Winkler <tomas.winkler@intel.com>
+Date: Thu, 23 Jun 2016 00:25:31 +0300
+Subject: mei: fix return value on disconnection
+
+From: Tomas Winkler <tomas.winkler@intel.com>
+
+commit 2d4d5481e2d6f93b25fcfb13a9f20bbfbf54266a upstream.
+
+Correct errno on client disconnection is -ENODEV not -EBUSY
+
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/amthif.c | 2 +-
+ drivers/misc/mei/bus.c | 2 +-
+ drivers/misc/mei/main.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/misc/mei/amthif.c
++++ b/drivers/misc/mei/amthif.c
+@@ -139,7 +139,7 @@ int mei_amthif_read(struct mei_device *d
+ return -ERESTARTSYS;
+
+ if (!mei_cl_is_connected(cl)) {
+- rets = -EBUSY;
++ rets = -ENODEV;
+ goto out;
+ }
+
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -142,7 +142,7 @@ ssize_t __mei_cl_recv(struct mei_cl *cl,
+ mutex_lock(&bus->device_lock);
+
+ if (!mei_cl_is_connected(cl)) {
+- rets = -EBUSY;
++ rets = -ENODEV;
+ goto out;
+ }
+ }
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -202,7 +202,7 @@ static ssize_t mei_read(struct file *fil
+
+ mutex_lock(&dev->device_lock);
+ if (!mei_cl_is_connected(cl)) {
+- rets = -EBUSY;
++ rets = -ENODEV;
+ goto out;
+ }
+ }
--- /dev/null
+From ac182e8abc6f93c1c4cc12f042af64c9d7be0d1e Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Mon, 12 Sep 2016 16:21:43 +0300
+Subject: mei: me: add kaby point device ids
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit ac182e8abc6f93c1c4cc12f042af64c9d7be0d1e upstream.
+
+Add device ids for Intel Kabypoint PCH (Kabylake)
+
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/hw-me-regs.h | 3 +++
+ drivers/misc/mei/pci-me.c | 3 +++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -125,6 +125,9 @@
+ #define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */
+ #define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */
+
++#define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
++#define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */
++
+ /*
+ * MEI HW Section
+ */
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -91,6 +91,9 @@ static const struct pci_device_id mei_me
+ {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, mei_me_pch8_cfg)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, mei_me_pch8_cfg)},
++
+ /* required last entry */
+ {0, }
+ };
--- /dev/null
+From 0ed50abb2d8fc81570b53af25621dad560cd49b3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20Gl=C3=B6ckner?= <dg@emlix.com>
+Date: Tue, 30 Aug 2016 14:17:30 +0200
+Subject: mmc: block: don't use CMD23 with very old MMC cards
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Glöckner <dg@emlix.com>
+
+commit 0ed50abb2d8fc81570b53af25621dad560cd49b3 upstream.
+
+CMD23 aka SET_BLOCK_COUNT was introduced with MMC v3.1.
+Older versions of the specification allowed to terminate
+multi-block transfers only with CMD12.
+
+The patch fixes the following problem:
+
+ mmc0: new MMC card at address 0001
+ mmcblk0: mmc0:0001 SDMB-16 15.3 MiB
+ mmcblk0: timed out sending SET_BLOCK_COUNT command, card status 0x400900
+ ...
+ blk_update_request: I/O error, dev mmcblk0, sector 0
+ Buffer I/O error on dev mmcblk0, logical block 0, async page read
+ mmcblk0: unable to read partition table
+
+Signed-off-by: Daniel Glöckner <dg@emlix.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/card/block.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -2303,7 +2303,8 @@ again:
+ set_capacity(md->disk, size);
+
+ if (mmc_host_cmd23(card->host)) {
+- if (mmc_card_mmc(card) ||
++ if ((mmc_card_mmc(card) &&
++ card->csd.mmca_vsn >= CSD_SPEC_VER_3) ||
+ (mmc_card_sd(card) &&
+ card->scr.cmds & SD_SCR_CMD23_SUPPORT))
+ md->flags |= MMC_BLK_CMD23;
--- /dev/null
+From 02265cd60335a2c1417abae4192611e1fc05a6e5 Mon Sep 17 00:00:00 2001
+From: Haibo Chen <haibo.chen@nxp.com>
+Date: Mon, 17 Oct 2016 10:18:37 +0200
+Subject: mmc: sdhci: cast unsigned int to unsigned long long to avoid unexpeted error
+
+From: Haibo Chen <haibo.chen@nxp.com>
+
+commit 02265cd60335a2c1417abae4192611e1fc05a6e5 upstream.
+
+Potentially overflowing expression 1000000 * data->timeout_clks with
+type unsigned int is evaluated using 32-bit arithmetic, and then used
+in a context that expects an expression of type unsigned long long.
+
+To avoid overflow, cast 1000000U to type unsigned long long.
+Special thanks to Coverity.
+
+Fixes: 7f05538af71c ("mmc: sdhci: fix data timeout (part 2)")
+Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -687,7 +687,7 @@ static u8 sdhci_calc_timeout(struct sdhc
+ * host->clock is in Hz. target_timeout is in us.
+ * Hence, us = 1000000 * cycles / Hz. Round up.
+ */
+- val = 1000000 * data->timeout_clks;
++ val = 1000000ULL * data->timeout_clks;
+ if (do_div(val, host->clock))
+ target_timeout++;
+ target_timeout += val;
--- /dev/null
+From 8e2e03179923479ca0c0b6fdc7c93ecf89bce7a8 Mon Sep 17 00:00:00 2001
+From: Maik Broemme <mbroemme@libmpq.org>
+Date: Tue, 9 Aug 2016 16:41:31 +0200
+Subject: PCI: Mark Atheros AR9580 to avoid bus reset
+
+From: Maik Broemme <mbroemme@libmpq.org>
+
+commit 8e2e03179923479ca0c0b6fdc7c93ecf89bce7a8 upstream.
+
+Similar to the AR93xx and the AR94xx series, the AR95xx also have the same
+quirk for the Bus Reset. It will lead to instant system reset if the
+device is assigned via VFIO to a KVM VM. I've been able reproduce this
+behavior with a MikroTik R11e-2HnD.
+
+Fixes: c3e59ee4e766 ("PCI: Mark Atheros AR93xx to avoid bus reset")
+Signed-off-by: Maik Broemme <mbroemme@libmpq.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3198,6 +3198,7 @@ static void quirk_no_bus_reset(struct pc
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
+
+ static void quirk_no_pm_reset(struct pci_dev *dev)
+ {
--- /dev/null
+From 8dd99bca7bfa4b62753b556c45d26f45ec9da6e6 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Wed, 5 Oct 2016 16:04:13 -0500
+Subject: PCI: tegra: Fix argument order in tegra_pcie_phy_disable()
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 8dd99bca7bfa4b62753b556c45d26f45ec9da6e6 upstream.
+
+The tegra_pcie_phy_disable() path called pads_writel() with arguments in
+the wrong order. Swap them to be the "value, offset" order expected by
+pads_writel().
+
+Fixes: 6fe7c187e026 ("PCI: tegra: Support per-lane PHYs")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pci-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pci-tegra.c
++++ b/drivers/pci/host/pci-tegra.c
+@@ -856,7 +856,7 @@ static int tegra_pcie_phy_disable(struct
+ /* override IDDQ */
+ value = pads_readl(pcie, PADS_CTL);
+ value |= PADS_CTL_IDDQ_1L;
+- pads_writel(pcie, PADS_CTL, value);
++ pads_writel(pcie, value, PADS_CTL);
+
+ /* reset PLL */
+ value = pads_readl(pcie, soc->pads_pll_ctl);
--- /dev/null
+From c8a9a6daccad495c48d5435d3487956ce01bc6a1 Mon Sep 17 00:00:00 2001
+From: Lin Huang <hl@rock-chips.com>
+Date: Thu, 4 Aug 2016 19:32:33 +0900
+Subject: PM / devfreq: event: remove duplicate devfreq_event_get_drvdata()
+
+From: Lin Huang <hl@rock-chips.com>
+
+commit c8a9a6daccad495c48d5435d3487956ce01bc6a1 upstream.
+
+there define two devfreq_event_get_drvdata() function in devfreq-event.h
+when disable CONFIG_PM_DEVFREQ_EVENT, it will lead to build fail. So
+remove devfreq_event_get_drvdata() function.
+
+Fixes: f262f28c1470 ("PM / devfreq: event: Add devfreq_event class")
+Signed-off-by: Lin Huang <hl@rock-chips.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: MyungJoo Ham <myungjoo.ham@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/devfreq-event.h | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/include/linux/devfreq-event.h
++++ b/include/linux/devfreq-event.h
+@@ -148,11 +148,6 @@ static inline int devfreq_event_reset_ev
+ return -EINVAL;
+ }
+
+-static inline void *devfreq_event_get_drvdata(struct devfreq_event_dev *edev)
+-{
+- return ERR_PTR(-EINVAL);
+-}
+-
+ static inline struct devfreq_event_dev *devfreq_event_get_edev_by_phandle(
+ struct device *dev, int index)
+ {
--- /dev/null
+From 8f9165c981fed187bb483de84caf9adf835aefda Mon Sep 17 00:00:00 2001
+From: Jan Remmet <j.remmet@phytec.de>
+Date: Fri, 23 Sep 2016 10:52:00 +0200
+Subject: regulator: tps65910: Work around silicon erratum SWCZ010
+
+From: Jan Remmet <j.remmet@phytec.de>
+
+commit 8f9165c981fed187bb483de84caf9adf835aefda upstream.
+
+http://www.ti.com/lit/pdf/SWCZ010:
+ DCDC o/p voltage can go higher than programmed value
+
+Impact:
+VDDI, VDD2, and VIO output programmed voltage level can go higher than
+expected or crash, when coming out of PFM to PWM mode or using DVFS.
+
+Description:
+When DCDC CLK SYNC bits are 11/01:
+* VIO 3-MHz oscillator is the source clock of the digital core and input
+ clock of VDD1 and VDD2
+* Turn-on of VDD1 and VDD2 HSD PFETis synchronized or at a constant
+ phase shift
+* Current pulled though VCC1+VCC2 is Iload(VDD1) + Iload(VDD2)
+* The 3 HSD PFET will be turned-on at the same time, causing the highest
+ possible switching noise on the application. This noise level depends
+ on the layout, the VBAT level, and the load current. The noise level
+ increases with improper layout.
+
+When DCDC CLK SYNC bits are 00:
+* VIO 3-MHz oscillator is the source clock of digital core
+* VDD1 and VDD2 are running on their own 3-MHz oscillator
+* Current pulled though VCC1+VCC2 average of Iload(VDD1) + Iload(VDD2)
+* The switching noise of the 3 SMPS will be randomly spread over time,
+ causing lower overall switching noise.
+
+Workaround:
+Set DCDCCTRL_REG[1:0]= 00.
+
+Signed-off-by: Jan Remmet <j.remmet@phytec.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/tps65910-regulator.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/regulator/tps65910-regulator.c
++++ b/drivers/regulator/tps65910-regulator.c
+@@ -1111,6 +1111,12 @@ static int tps65910_probe(struct platfor
+ pmic->num_regulators = ARRAY_SIZE(tps65910_regs);
+ pmic->ext_sleep_control = tps65910_ext_sleep_control;
+ info = tps65910_regs;
++ /* Work around silicon erratum SWCZ010: output programmed
++ * voltage level can go higher than expected or crash
++ * Workaround: use no synchronization of DCDC clocks
++ */
++ tps65910_reg_clear_bits(pmic->mfd, TPS65910_DCDCCTRL,
++ DCDCCTRL_DCDCCKSYNC_MASK);
+ break;
+ case TPS65911:
+ pmic->get_ctrl_reg = &tps65911_get_ctrl_register;
--- /dev/null
+From 0c9d3491530773858ff9d705ec2a9c382f449230 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 22 Aug 2016 14:27:59 -0500
+Subject: rtlwifi: Fix missing country code for Great Britain
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 0c9d3491530773858ff9d705ec2a9c382f449230 upstream.
+
+Some RTL8821AE devices sold in Great Britain have the country code of
+0x25 encoded in their EEPROM. This value is not tested in the routine
+that establishes the regulatory info for the chip. The fix is to set
+this code to have the same capabilities as the EU countries. In addition,
+the channels allowed for COUNTRY_CODE_ETSI were more properly suited
+for China and Israel, not the EU. This problem has also been fixed.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/realtek/rtlwifi/regd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtlwifi/regd.c
++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c
+@@ -345,9 +345,9 @@ static const struct ieee80211_regdomain
+ return &rtl_regdom_no_midband;
+ case COUNTRY_CODE_IC:
+ return &rtl_regdom_11;
+- case COUNTRY_CODE_ETSI:
+ case COUNTRY_CODE_TELEC_NETGEAR:
+ return &rtl_regdom_60_64;
++ case COUNTRY_CODE_ETSI:
+ case COUNTRY_CODE_SPAIN:
+ case COUNTRY_CODE_FRANCE:
+ case COUNTRY_CODE_ISRAEL:
+@@ -406,6 +406,8 @@ static u8 channel_plan_to_country_code(u
+ return COUNTRY_CODE_WORLD_WIDE_13;
+ case 0x22:
+ return COUNTRY_CODE_IC;
++ case 0x25:
++ return COUNTRY_CODE_ETSI;
+ case 0x32:
+ return COUNTRY_CODE_TELEC_NETGEAR;
+ case 0x41:
gpio-mpc8xxx-correct-irq-handler-function.patch
+mei-fix-return-value-on-disconnection.patch
+mei-me-add-kaby-point-device-ids.patch
+regulator-tps65910-work-around-silicon-erratum-swcz010.patch
+clk-imx6-initialize-gpu-clocks.patch
+clk-imx6-fix-i.mx6dl-clock-tree-to-reflect-reality.patch
+spi-spidev_test-fix-buffer-overflow-in-unescape.patch
+pm-devfreq-event-remove-duplicate-devfreq_event_get_drvdata.patch
+ath10k-fix-copy-engine-5-destination-ring-stuck.patch
+rtlwifi-fix-missing-country-code-for-great-britain.patch
+mmc-block-don-t-use-cmd23-with-very-old-mmc-cards.patch
+mmc-sdhci-cast-unsigned-int-to-unsigned-long-long-to-avoid-unexpeted-error.patch
+pci-mark-atheros-ar9580-to-avoid-bus-reset.patch
+pci-tegra-fix-argument-order-in-tegra_pcie_phy_disable.patch
--- /dev/null
+From 0278b34bf15f8d8a609595b15909cd8622dd64ca Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 9 Sep 2016 09:02:51 +0200
+Subject: spi: spidev_test: Fix buffer overflow in unescape()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 0278b34bf15f8d8a609595b15909cd8622dd64ca upstream.
+
+Sometimes spidev_test crashes with:
+
+ *** Error in `spidev_test': munmap_chunk(): invalid pointer: 0x00022020 ***
+ Aborted
+
+or just
+
+ Segmentation fault
+
+This is due to transfer_escaped_string() miscalculating the required
+size of the buffer by one byte, causing a buffer overflow in unescape().
+
+Drop the bogus "+ 1" in the strlen() parameter to fix this.
+
+Note that unescape() never copies the zero-terminator of the source
+string, so it writes at most as many bytes as the length of the source
+string.
+
+Fixes: 30061915be6e3a2c (spi: spidev_test: Added input buffer from the terminal)
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/spi/spidev_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/spi/spidev_test.c
++++ b/tools/spi/spidev_test.c
+@@ -284,7 +284,7 @@ static void parse_opts(int argc, char *a
+
+ static void transfer_escaped_string(int fd, char *str)
+ {
+- size_t size = strlen(str + 1);
++ size_t size = strlen(str);
+ uint8_t *tx;
+ uint8_t *rx;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
