--- /dev/null
+From 982b0b2dd590c00f089fc6fe915bd0cb302a7f5c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 9 Sep 2015 16:52:09 +0200
+Subject: drm/i915: Fix CSR MMIO address check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 982b0b2dd590c00f089fc6fe915bd0cb302a7f5c upstream.
+
+Fix a wrong logical AND (&&) used for the range check of CSR MMIO.
+
+Spotted nicely by gcc -Wlogical-op flag:
+ drivers/gpu/drm/i915/intel_csr.c: In function ‘finish_csr_load’:
+ drivers/gpu/drm/i915/intel_csr.c:353:41: warning: logical ‘and’ of mutually exclusive tests is always false [-Wlogical-op]
+
+Fixes: eb805623d8b1 ('drm/i915/skl: Add support to load SKL CSR firmware.')
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Reviewed-by: Animesh Manna <animesh.manna@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_csr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_csr.c
++++ b/drivers/gpu/drm/i915/intel_csr.c
+@@ -350,7 +350,7 @@ static void finish_csr_load(const struct
+ }
+ csr->mmio_count = dmc_header->mmio_count;
+ for (i = 0; i < dmc_header->mmio_count; i++) {
+- if (dmc_header->mmioaddr[i] < CSR_MMIO_START_RANGE &&
++ if (dmc_header->mmioaddr[i] < CSR_MMIO_START_RANGE ||
+ dmc_header->mmioaddr[i] > CSR_MMIO_END_RANGE) {
+ DRM_ERROR(" Firmware has wrong mmio address 0x%x\n",
+ dmc_header->mmioaddr[i]);
--- /dev/null
+From acd29f7b22262d9e848393b9b6ae13eb42d22514 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Tue, 8 Sep 2015 14:17:13 +0100
+Subject: drm/i915: Limit the number of loops for reading a split 64bit register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit acd29f7b22262d9e848393b9b6ae13eb42d22514 upstream.
+
+In I915_READ64_2x32 we attempt to read a 64bit register using 2 32bit
+reads. Due to the nature of the registers we try to read in this manner,
+they may increment between the two instruction (e.g. a timestamp
+counter). To keep the result accurate, we repeat the read if we detect
+an overflow (i.e. the upper value varies). However, some hardware is just
+plain flaky and may endless loop as the the upper 32bits are not stable.
+Just give up after a couple of tries and report whatever we read last.
+
+v2: Use the most recent values when erring out on an unstable register.
+
+Reported-by: russianneuromancer@ya.ru
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91906
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Michał Winiarski <michal.winiarski@intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_drv.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -3303,13 +3303,13 @@ int intel_freq_opcode(struct drm_i915_pr
+ #define I915_READ64(reg) dev_priv->uncore.funcs.mmio_readq(dev_priv, (reg), true)
+
+ #define I915_READ64_2x32(lower_reg, upper_reg) ({ \
+- u32 upper, lower, tmp; \
+- tmp = I915_READ(upper_reg); \
++ u32 upper, lower, old_upper, loop = 0; \
++ upper = I915_READ(upper_reg); \
+ do { \
+- upper = tmp; \
++ old_upper = upper; \
+ lower = I915_READ(lower_reg); \
+- tmp = I915_READ(upper_reg); \
+- } while (upper != tmp); \
++ upper = I915_READ(upper_reg); \
++ } while (upper != old_upper && loop++ < 2); \
+ (u64)upper << 32 | lower; })
+
+ #define POSTING_READ(reg) (void)I915_READ_NOTRACE(reg)
--- /dev/null
+From 001fceb9c64a39aebb85d31134182d39c1628a21 Mon Sep 17 00:00:00 2001
+From: Hartmut Knaack <knaack.h@gmx.de>
+Date: Sun, 2 Aug 2015 22:43:46 +0200
+Subject: iio:accel:mma8452: fix _get_hp_filter_index
+
+From: Hartmut Knaack <knaack.h@gmx.de>
+
+commit 001fceb9c64a39aebb85d31134182d39c1628a21 upstream.
+
+To iterate through the available frequencies of mma8452_hp_filter_cutoff[],
+the array size of a row of that table needs to be provided to
+_get_int_plus_micros_index().
+
+Fixes: 1e79841a00e46 ("iio: mma8452: Add highpass filter configuration.")
+
+Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/mma8452.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/accel/mma8452.c
++++ b/drivers/iio/accel/mma8452.c
+@@ -229,7 +229,7 @@ static int mma8452_get_hp_filter_index(s
+ int i = mma8452_get_odr_index(data);
+
+ return mma8452_get_int_plus_micros_index(mma8452_hp_filter_cutoff[i],
+- ARRAY_SIZE(mma8452_scales[0]), val, val2);
++ ARRAY_SIZE(mma8452_hp_filter_cutoff[0]), val, val2);
+ }
+
+ static int mma8452_read_hp_filter(struct mma8452_data *data, int *hz, int *uHz)
--- /dev/null
+From c689a923c867eac40ed3826c1d9328edea8b6bc7 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 5 Aug 2015 15:38:14 +0200
+Subject: iio: Add inverse unit conversion macros
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit c689a923c867eac40ed3826c1d9328edea8b6bc7 upstream.
+
+Add inverse unit conversion macro to convert from standard IIO units to
+units that might be used by some devices.
+
+Those are useful in combination with scale factors that are specified as
+IIO_VAL_FRACTIONAL. Typically the denominator for those specifications will
+contain the maximum raw value the sensor will generate and the numerator
+the value it maps to in a specific unit. Sometimes datasheets specify those
+in different units than the standard IIO units (e.g. degree/s instead of
+rad/s) and so we need to do a unit conversion.
+
+From a mathematical point of view it does not make a difference whether we
+apply the unit conversion to the numerator or the inverse unit conversion
+to the denominator since (x / y) / z = x / (y * z). But as the denominator
+is typically a larger value and we are rounding both the numerator and
+denominator to integer values using the later method gives us a better
+precision (E.g. the relative error is smaller if we round 8000.3 to 8000
+rather than rounding 8.3 to 8).
+
+This is where in inverse unit conversion macros will be used.
+
+Marked for stable as used by some upcoming fixes.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/iio/iio.h | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/include/linux/iio/iio.h
++++ b/include/linux/iio/iio.h
+@@ -645,6 +645,15 @@ int iio_str_to_fixpoint(const char *str,
+ #define IIO_DEGREE_TO_RAD(deg) (((deg) * 314159ULL + 9000000ULL) / 18000000ULL)
+
+ /**
++ * IIO_RAD_TO_DEGREE() - Convert rad to degree
++ * @rad: A value in rad
++ *
++ * Returns the given value converted from rad to degree
++ */
++#define IIO_RAD_TO_DEGREE(rad) \
++ (((rad) * 18000000ULL + 314159ULL / 2) / 314159ULL)
++
++/**
+ * IIO_G_TO_M_S_2() - Convert g to meter / second**2
+ * @g: A value in g
+ *
+@@ -652,4 +661,12 @@ int iio_str_to_fixpoint(const char *str,
+ */
+ #define IIO_G_TO_M_S_2(g) ((g) * 980665ULL / 100000ULL)
+
++/**
++ * IIO_M_S_2_TO_G() - Convert meter / second**2 to g
++ * @ms2: A value in meter / second**2
++ *
++ * Returns the given value converted from meter / second**2 to g
++ */
++#define IIO_M_S_2_TO_G(ms2) (((ms2) * 100000ULL + 980665ULL / 2) / 980665ULL)
++
+ #endif /* _INDUSTRIAL_IO_H_ */
--- /dev/null
+From 8166537283b31d7abaae9e56bd48fbbc30cdc579 Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 5 Aug 2015 15:38:13 +0200
+Subject: iio: adis16400: Fix adis16448 gyroscope scale
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit 8166537283b31d7abaae9e56bd48fbbc30cdc579 upstream.
+
+Use the correct scale for the adis16448 gyroscope output.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/imu/adis16400_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/imu/adis16400_core.c
++++ b/drivers/iio/imu/adis16400_core.c
+@@ -780,7 +780,7 @@ static struct adis16400_chip_info adis16
+ .flags = ADIS16400_HAS_PROD_ID |
+ ADIS16400_HAS_SERIAL_NUMBER |
+ ADIS16400_BURST_DIAG_STAT,
+- .gyro_scale_micro = IIO_DEGREE_TO_RAD(10000), /* 0.01 deg/s */
++ .gyro_scale_micro = IIO_DEGREE_TO_RAD(40000), /* 0.04 deg/s */
+ .accel_scale_micro = IIO_G_TO_M_S_2(833), /* 1/1200 g */
+ .temp_scale_nano = 73860000, /* 0.07386 C */
+ .temp_offset = 31000000 / 73860, /* 31 C = 0x00 */
--- /dev/null
+From 7abad1063deb0f77d275c61f58863ec319c58c5c Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 5 Aug 2015 15:38:15 +0200
+Subject: iio: adis16480: Fix scale factors
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit 7abad1063deb0f77d275c61f58863ec319c58c5c upstream.
+
+The different devices support by the adis16480 driver have slightly
+different scales for the gyroscope and accelerometer channels.
+
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/imu/adis16480.c | 39 +++++++++++++++++++++++++++++++++------
+ 1 file changed, 33 insertions(+), 6 deletions(-)
+
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -110,6 +110,10 @@
+ struct adis16480_chip_info {
+ unsigned int num_channels;
+ const struct iio_chan_spec *channels;
++ unsigned int gyro_max_val;
++ unsigned int gyro_max_scale;
++ unsigned int accel_max_val;
++ unsigned int accel_max_scale;
+ };
+
+ struct adis16480 {
+@@ -497,19 +501,21 @@ static int adis16480_set_filter_freq(str
+ static int adis16480_read_raw(struct iio_dev *indio_dev,
+ const struct iio_chan_spec *chan, int *val, int *val2, long info)
+ {
++ struct adis16480 *st = iio_priv(indio_dev);
++
+ switch (info) {
+ case IIO_CHAN_INFO_RAW:
+ return adis_single_conversion(indio_dev, chan, 0, val);
+ case IIO_CHAN_INFO_SCALE:
+ switch (chan->type) {
+ case IIO_ANGL_VEL:
+- *val = 0;
+- *val2 = IIO_DEGREE_TO_RAD(20000); /* 0.02 degree/sec */
+- return IIO_VAL_INT_PLUS_MICRO;
++ *val = st->chip_info->gyro_max_scale;
++ *val2 = st->chip_info->gyro_max_val;
++ return IIO_VAL_FRACTIONAL;
+ case IIO_ACCEL:
+- *val = 0;
+- *val2 = IIO_G_TO_M_S_2(800); /* 0.8 mg */
+- return IIO_VAL_INT_PLUS_MICRO;
++ *val = st->chip_info->accel_max_scale;
++ *val2 = st->chip_info->accel_max_val;
++ return IIO_VAL_FRACTIONAL;
+ case IIO_MAGN:
+ *val = 0;
+ *val2 = 100; /* 0.0001 gauss */
+@@ -674,18 +680,39 @@ static const struct adis16480_chip_info
+ [ADIS16375] = {
+ .channels = adis16485_channels,
+ .num_channels = ARRAY_SIZE(adis16485_channels),
++ /*
++ * storing the value in rad/degree and the scale in degree
++ * gives us the result in rad and better precession than
++ * storing the scale directly in rad.
++ */
++ .gyro_max_val = IIO_RAD_TO_DEGREE(22887),
++ .gyro_max_scale = 300,
++ .accel_max_val = IIO_M_S_2_TO_G(21973),
++ .accel_max_scale = 18,
+ },
+ [ADIS16480] = {
+ .channels = adis16480_channels,
+ .num_channels = ARRAY_SIZE(adis16480_channels),
++ .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
++ .gyro_max_scale = 450,
++ .accel_max_val = IIO_M_S_2_TO_G(12500),
++ .accel_max_scale = 5,
+ },
+ [ADIS16485] = {
+ .channels = adis16485_channels,
+ .num_channels = ARRAY_SIZE(adis16485_channels),
++ .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
++ .gyro_max_scale = 450,
++ .accel_max_val = IIO_M_S_2_TO_G(20000),
++ .accel_max_scale = 5,
+ },
+ [ADIS16488] = {
+ .channels = adis16480_channels,
+ .num_channels = ARRAY_SIZE(adis16480_channels),
++ .gyro_max_val = IIO_RAD_TO_DEGREE(22500),
++ .gyro_max_scale = 450,
++ .accel_max_val = IIO_M_S_2_TO_G(22500),
++ .accel_max_scale = 18,
+ },
+ };
+
--- /dev/null
+From 06d2f6ca5a38abe92f1f3a132b331eee773868c3 Mon Sep 17 00:00:00 2001
+From: Markus Pargmann <mpa@pengutronix.de>
+Date: Wed, 29 Jul 2015 15:46:03 +0200
+Subject: iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required
+
+From: Markus Pargmann <mpa@pengutronix.de>
+
+commit 06d2f6ca5a38abe92f1f3a132b331eee773868c3 upstream.
+
+This patch adds selects for IIO_BUFFER and IIO_TRIGGERED_BUFFER. Without
+IIO_BUFFER, the driver does not compile.
+
+Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
+Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/gyro/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/gyro/Kconfig
++++ b/drivers/iio/gyro/Kconfig
+@@ -53,7 +53,8 @@ config ADXRS450
+ config BMG160
+ tristate "BOSCH BMG160 Gyro Sensor"
+ depends on I2C
+- select IIO_TRIGGERED_BUFFER if IIO_BUFFER
++ select IIO_BUFFER
++ select IIO_TRIGGERED_BUFFER
+ help
+ Say yes here to build support for Bosch BMG160 Tri-axis Gyro Sensor
+ driver. This driver also supports BMI055 gyroscope.
--- /dev/null
+From 41d903c00051d8f31c98a8136edbac67e6f8688f Mon Sep 17 00:00:00 2001
+From: Cristina Opriceana <cristina.opriceana@gmail.com>
+Date: Mon, 3 Aug 2015 13:00:47 +0300
+Subject: iio: event: Remove negative error code from iio_event_poll
+
+From: Cristina Opriceana <cristina.opriceana@gmail.com>
+
+commit 41d903c00051d8f31c98a8136edbac67e6f8688f upstream.
+
+Negative return values are not supported by iio_event_poll since
+its return type is unsigned int.
+
+Fixes: f18e7a068a0a3 ("iio: Return -ENODEV for file operations if the device has been unregistered")
+
+Signed-off-by: Cristina Opriceana <cristina.opriceana@gmail.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/industrialio-event.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/industrialio-event.c
++++ b/drivers/iio/industrialio-event.c
+@@ -84,7 +84,7 @@ static unsigned int iio_event_poll(struc
+ unsigned int events = 0;
+
+ if (!indio_dev->info)
+- return -ENODEV;
++ return events;
+
+ poll_wait(filep, &ev_int->wait, wait);
+
--- /dev/null
+From 1bdc0293901cbea23c6dc29432e81919d4719844 Mon Sep 17 00:00:00 2001
+From: Cristina Opriceana <cristina.opriceana@gmail.com>
+Date: Mon, 3 Aug 2015 13:37:40 +0300
+Subject: iio: industrialio-buffer: Fix iio_buffer_poll return value
+
+From: Cristina Opriceana <cristina.opriceana@gmail.com>
+
+commit 1bdc0293901cbea23c6dc29432e81919d4719844 upstream.
+
+Change return value to 0 if no device is bound since
+unsigned int cannot support negative error codes.
+
+Fixes: f18e7a068 ("iio: Return -ENODEV for file operations if the
+device has been unregistered")
+
+Signed-off-by: Cristina Opriceana <cristina.opriceana@gmail.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/industrialio-buffer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -151,7 +151,7 @@ unsigned int iio_buffer_poll(struct file
+ struct iio_buffer *rb = indio_dev->buffer;
+
+ if (!indio_dev->info)
+- return -ENODEV;
++ return 0;
+
+ poll_wait(filp, &rb->pollq, wait);
+ if (iio_buffer_ready(indio_dev, rb, rb->watermark, 0))
--- /dev/null
+From 89b1145e93771d727645c96e323539c029b63f1c Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Fri, 14 Aug 2015 13:20:28 +0200
+Subject: s390/setup: fix novx parameter
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+commit 89b1145e93771d727645c96e323539c029b63f1c upstream.
+
+The novx parameter disables the vector facility but the HWCAP_S390_VXRS
+bit in the ELf hardware capabilies is always set if the machine has
+the vector facility. If the user space program uses the "vx" string
+in the features field of /proc/cpuinfo to utilize vector instruction
+it will crash if the novx kernel paramter is set.
+
+Convert setup_hwcaps to an arch_initcall and use MACHINE_HAS_VX to
+decide if the HWCAPS_S390_VXRS bit needs to be set.
+
+Reported-by: Ulrich Weigand <uweigand@de.ibm.com>
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/setup.c | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -688,7 +688,7 @@ static void __init setup_memory(void)
+ /*
+ * Setup hardware capabilities.
+ */
+-static void __init setup_hwcaps(void)
++static int __init setup_hwcaps(void)
+ {
+ static const int stfl_bits[6] = { 0, 2, 7, 17, 19, 21 };
+ struct cpuid cpu_id;
+@@ -754,9 +754,11 @@ static void __init setup_hwcaps(void)
+ elf_hwcap |= HWCAP_S390_TE;
+
+ /*
+- * Vector extension HWCAP_S390_VXRS is bit 11.
++ * Vector extension HWCAP_S390_VXRS is bit 11. The Vector extension
++ * can be disabled with the "novx" parameter. Use MACHINE_HAS_VX
++ * instead of facility bit 129.
+ */
+- if (test_facility(129))
++ if (MACHINE_HAS_VX)
+ elf_hwcap |= HWCAP_S390_VXRS;
+ get_cpu_id(&cpu_id);
+ add_device_randomness(&cpu_id, sizeof(cpu_id));
+@@ -793,7 +795,9 @@ static void __init setup_hwcaps(void)
+ strcpy(elf_platform, "z13");
+ break;
+ }
++ return 0;
+ }
++arch_initcall(setup_hwcaps);
+
+ /*
+ * Add system information as device randomness
+@@ -881,11 +885,6 @@ void __init setup_arch(char **cmdline_p)
+ cpu_init();
+
+ /*
+- * Setup capabilities (ELF_HWCAP & ELF_PLATFORM).
+- */
+- setup_hwcaps();
+-
+- /*
+ * Create kernel page tables and switch to virtual addressing.
+ */
+ paging_init();
--- /dev/null
+From dd9d3843755da95f63dd3a376f62b3e45c011210 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20H=2E=20Sch=C3=B6nherr?= <jschoenh@amazon.de>
+Date: Wed, 12 Aug 2015 21:35:56 +0200
+Subject: sched: Fix cpu_active_mask/cpu_online_mask race
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Jan=20H=2E=20Sch=C3=B6nherr?= <jschoenh@amazon.de>
+
+commit dd9d3843755da95f63dd3a376f62b3e45c011210 upstream.
+
+There is a race condition in SMP bootup code, which may result
+in
+
+ WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:4418
+ workqueue_cpu_up_callback()
+or
+ kernel BUG at kernel/smpboot.c:135!
+
+It can be triggered with a bit of luck in Linux guests running
+on busy hosts.
+
+ CPU0 CPUn
+ ==== ====
+
+ _cpu_up()
+ __cpu_up()
+ start_secondary()
+ set_cpu_online()
+ cpumask_set_cpu(cpu,
+ to_cpumask(cpu_online_bits));
+ cpu_notify(CPU_ONLINE)
+ <do stuff, see below>
+ cpumask_set_cpu(cpu,
+ to_cpumask(cpu_active_bits));
+
+During the various CPU_ONLINE callbacks CPUn is online but not
+active. Several things can go wrong at that point, depending on
+the scheduling of tasks on CPU0.
+
+Variant 1:
+
+ cpu_notify(CPU_ONLINE)
+ workqueue_cpu_up_callback()
+ rebind_workers()
+ set_cpus_allowed_ptr()
+
+ This call fails because it requires an active CPU; rebind_workers()
+ ends with a warning:
+
+ WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:4418
+ workqueue_cpu_up_callback()
+
+Variant 2:
+
+ cpu_notify(CPU_ONLINE)
+ smpboot_thread_call()
+ smpboot_unpark_threads()
+ ..
+ __kthread_unpark()
+ __kthread_bind()
+ wake_up_state()
+ ..
+ select_task_rq()
+ select_fallback_rq()
+
+ The ->wake_cpu of the unparked thread is not allowed, making a call
+ to select_fallback_rq() necessary. Then, select_fallback_rq() cannot
+ find an allowed, active CPU and promptly resets the allowed CPUs, so
+ that the task in question ends up on CPU0.
+
+ When those unparked tasks are eventually executed, they run
+ immediately into a BUG:
+
+ kernel BUG at kernel/smpboot.c:135!
+
+Just changing the order in which the online/active bits are set
+(and adding some memory barriers), would solve the two issues
+above. However, it would change the order of operations back to
+the one before commit 6acbfb96976f ("sched: Fix hotplug vs.
+set_cpus_allowed_ptr()"), thus, reintroducing that particular
+problem.
+
+Going further back into history, we have at least the following
+commits touching this topic:
+- commit 2baab4e90495 ("sched: Fix select_fallback_rq() vs cpu_active/cpu_online")
+- commit 5fbd036b552f ("sched: Cleanup cpu_active madness")
+
+Together, these give us the following non-working solutions:
+
+ - secondary CPU sets active before online, because active is assumed to
+ be a subset of online;
+
+ - secondary CPU sets online before active, because the primary CPU
+ assumes that an online CPU is also active;
+
+ - secondary CPU sets online and waits for primary CPU to set active,
+ because it might deadlock.
+
+Commit 875ebe940d77 ("powerpc/smp: Wait until secondaries are
+active & online") introduces an arch-specific solution to this
+arch-independent problem.
+
+Now, go for a more general solution without explicit waiting and
+simply set active twice: once on the secondary CPU after online
+was set and once on the primary CPU after online was seen.
+
+set_cpus_allowed_ptr()")
+
+Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
+Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Anton Blanchard <anton@samba.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Joerg Roedel <jroedel@suse.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matt Wilson <msw@amazon.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 6acbfb96976f ("sched: Fix hotplug vs. set_cpus_allowed_ptr()")
+Link: http://lkml.kernel.org/r/1439408156-18840-1-git-send-email-jschoenh@amazon.de
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sched/core.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5433,6 +5433,14 @@ static int sched_cpu_active(struct notif
+ case CPU_STARTING:
+ set_cpu_rq_start_time();
+ return NOTIFY_OK;
++ case CPU_ONLINE:
++ /*
++ * At this point a starting CPU has marked itself as online via
++ * set_cpu_online(). But it might not yet have marked itself
++ * as active, which is essential from here on.
++ *
++ * Thus, fall-through and help the starting CPU along.
++ */
+ case CPU_DOWN_FAILED:
+ set_cpu_active((long)hcpu, true);
+ return NOTIFY_OK;
drm-qxl-validate-monitors-config-modes.patch
drm-i915-allow-dsi-dual-link-to-be-configured-on-any-pipe.patch
drm-i915-always-mark-the-object-as-dirty-when-used-by-the-gpu.patch
+drm-i915-limit-the-number-of-loops-for-reading-a-split-64bit-register.patch
+drm-i915-fix-csr-mmio-address-check.patch
+s390-setup-fix-novx-parameter.patch
+iio-bmg160-iio_buffer-and-iio_triggered_buffer-are-required.patch
+iio-event-remove-negative-error-code-from-iio_event_poll.patch
+iio-industrialio-buffer-fix-iio_buffer_poll-return-value.patch
+iio-adis16400-fix-adis16448-gyroscope-scale.patch
+iio-add-inverse-unit-conversion-macros.patch
+iio-adis16480-fix-scale-factors.patch
+iio-accel-mma8452-fix-_get_hp_filter_index.patch
+sched-fix-cpu_active_mask-cpu_online_mask-race.patch
+staging-rtl8192e-fix-log-spamming-in-rtl8192_hard_data_xmit.patch
+staging-comedi-adl_pci7x3x-fix-digital-output-on-pci-7230.patch
+staging-comedi-usbduxsigma-don-t-clobber-ai_timer-in-command-test.patch
+staging-comedi-usbduxsigma-don-t-clobber-ao_timer-in-command-test.patch
+staging-unisys-allow-visorbus-to-autoload.patch
--- /dev/null
+From ad83dbd974feb2e2a8cc071a1d28782bd4d2c70e Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Tue, 11 Aug 2015 13:05:10 +0100
+Subject: staging: comedi: adl_pci7x3x: fix digital output on PCI-7230
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit ad83dbd974feb2e2a8cc071a1d28782bd4d2c70e upstream.
+
+The "adl_pci7x3x" driver replaced the "adl_pci7230" and "adl_pci7432"
+drivers in commits 8f567c373c4b ("staging: comedi: new adl_pci7x3x
+driver") and 657f77d173d3 ("staging: comedi: remove adl_pci7230 and
+adl_pci7432 drivers"). Although the new driver code agrees with the
+user manuals for the respective boards, digital outputs stopped working
+on the PCI-7230. This has 16 digital output channels and the previous
+adl_pci7230 driver shifted the 16 bit output state left by 16 bits
+before writing to the hardware register. The new adl_pci7x3x driver
+doesn't do that. Fix it in `adl_pci7x3x_do_insn_bits()` by checking
+for the special case of the subdevice having only 16 channels and
+duplicating the 16 bit output state into both halves of the 32-bit
+register. That should work both for what the board actually does and
+for what the user manual says it should do.
+
+Fixes: 8f567c373c4b ("staging: comedi: new adl_pci7x3x driver")
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/adl_pci7x3x.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/adl_pci7x3x.c
++++ b/drivers/staging/comedi/drivers/adl_pci7x3x.c
+@@ -120,8 +120,20 @@ static int adl_pci7x3x_do_insn_bits(stru
+ {
+ unsigned long reg = (unsigned long)s->private;
+
+- if (comedi_dio_update_state(s, data))
+- outl(s->state, dev->iobase + reg);
++ if (comedi_dio_update_state(s, data)) {
++ unsigned int val = s->state;
++
++ if (s->n_chan == 16) {
++ /*
++ * It seems the PCI-7230 needs the 16-bit DO state
++ * to be shifted left by 16 bits before being written
++ * to the 32-bit register. Set the value in both
++ * halves of the register to be sure.
++ */
++ val |= val << 16;
++ }
++ outl(val, dev->iobase + reg);
++ }
+
+ data[1] = s->state;
+
--- /dev/null
+From 423b24c37dd5794a674c74b0ed56392003a69891 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Thu, 23 Jul 2015 16:46:57 +0100
+Subject: staging: comedi: usbduxsigma: don't clobber ai_timer in command test
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 423b24c37dd5794a674c74b0ed56392003a69891 upstream.
+
+`devpriv->ai_timer` is used while an asynchronous command is running on
+the AI subdevice. It also gets modified by the subdevice's `cmdtest`
+handler for checking new asynchronous commands
+(`usbduxsigma_ai_cmdtest()`), which is not correct as it's allowed to
+check new commands while an old command is still running. Fix it by
+moving the code which sets up `devpriv->ai_timer` and
+`devpriv->ai_interval` into the subdevice's `cmd` handler,
+`usbduxsigma_ai_cmd()`.
+
+Note that the removed code in `usbduxsigma_ai_cmdtest()` checked that
+`devpriv->ai_timer` did not end up less than than 1, but that could not
+happen because `cmd->scan_begin_arg` had already been checked to be at
+least the minimum required value (at least when `cmd->scan_begin_src ==
+TRIG_TIMER`, which had also been checked to be the case).
+
+Fixes: b986be8527c7 ("staging: comedi: usbduxsigma: tidy up analog input command support)
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Reviewed-by: Bernd Porr <mail@berndporr.me.uk>
+Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/usbduxsigma.c | 37 +++++++++++----------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/usbduxsigma.c
++++ b/drivers/staging/comedi/drivers/usbduxsigma.c
+@@ -550,27 +550,6 @@ static int usbduxsigma_ai_cmdtest(struct
+ if (err)
+ return 3;
+
+- /* Step 4: fix up any arguments */
+-
+- if (high_speed) {
+- /*
+- * every 2 channels get a time window of 125us. Thus, if we
+- * sample all 16 channels we need 1ms. If we sample only one
+- * channel we need only 125us
+- */
+- devpriv->ai_interval = interval;
+- devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval);
+- } else {
+- /* interval always 1ms */
+- devpriv->ai_interval = 1;
+- devpriv->ai_timer = cmd->scan_begin_arg / 1000000;
+- }
+- if (devpriv->ai_timer < 1)
+- err |= -EINVAL;
+-
+- if (err)
+- return 4;
+-
+ return 0;
+ }
+
+@@ -668,6 +647,22 @@ static int usbduxsigma_ai_cmd(struct com
+
+ down(&devpriv->sem);
+
++ if (devpriv->high_speed) {
++ /*
++ * every 2 channels get a time window of 125us. Thus, if we
++ * sample all 16 channels we need 1ms. If we sample only one
++ * channel we need only 125us
++ */
++ unsigned int interval = usbduxsigma_chans_to_interval(len);
++
++ devpriv->ai_interval = interval;
++ devpriv->ai_timer = cmd->scan_begin_arg / (125000 * interval);
++ } else {
++ /* interval always 1ms */
++ devpriv->ai_interval = 1;
++ devpriv->ai_timer = cmd->scan_begin_arg / 1000000;
++ }
++
+ for (i = 0; i < len; i++) {
+ unsigned int chan = CR_CHAN(cmd->chanlist[i]);
+
--- /dev/null
+From c04a1f17803e0d3eeada586ca34a6b436959bc20 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Thu, 23 Jul 2015 16:46:58 +0100
+Subject: staging: comedi: usbduxsigma: don't clobber ao_timer in command test
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit c04a1f17803e0d3eeada586ca34a6b436959bc20 upstream.
+
+`devpriv->ao_timer` is used while an asynchronous command is running on
+the AO subdevice. It also gets modified by the subdevice's `cmdtest`
+handler for checking new asynchronous commands,
+`usbduxsigma_ao_cmdtest()`, which is not correct as it's allowed to
+check new commands while an old command is still running. Fix it by
+moving the code which sets up `devpriv->ao_timer` into the subdevice's
+`cmd` handler, `usbduxsigma_ao_cmd()`.
+
+Note that the removed code in `usbduxsigma_ao_cmdtest()` checked that
+`devpriv->ao_timer` did not end up less that 1, but that could not
+happen due because `cmd->scan_begin_arg` or `cmd->convert_arg` had
+already been range-checked.
+
+Also note that we tested the `high_speed` variable in the old code, but
+that is currently always 0 and means that we always use "scan" timing
+(`cmd->scan_begin_src == TRIG_TIMER` and `cmd->convert_src == TRIG_NOW`)
+and never "convert" (individual sample) timing (`cmd->scan_begin_src ==
+TRIG_FOLLOW` and `cmd->convert_src == TRIG_TIMER`). The moved code
+tests `cmd->convert_src` instead to decide whether "scan" or "convert"
+timing is being used, although currently only "scan" timing is
+supported.
+
+Fixes: fb1ef622e7a3 ("staging: comedi: usbduxsigma: tidy up analog output command support")
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Reviewed-by: Bernd Porr <mail@berndporr.me.uk>
+Reviewed-by: H Hartley Sweeten <hsweeten@visionengravers.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/usbduxsigma.c | 33 +++++++++++----------------
+ 1 file changed, 14 insertions(+), 19 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/usbduxsigma.c
++++ b/drivers/staging/comedi/drivers/usbduxsigma.c
+@@ -912,25 +912,6 @@ static int usbduxsigma_ao_cmdtest(struct
+ if (err)
+ return 3;
+
+- /* Step 4: fix up any arguments */
+-
+- /* we count in timer steps */
+- if (high_speed) {
+- /* timing of the conversion itself: every 125 us */
+- devpriv->ao_timer = cmd->convert_arg / 125000;
+- } else {
+- /*
+- * timing of the scan: every 1ms
+- * we get all channels at once
+- */
+- devpriv->ao_timer = cmd->scan_begin_arg / 1000000;
+- }
+- if (devpriv->ao_timer < 1)
+- err |= -EINVAL;
+-
+- if (err)
+- return 4;
+-
+ return 0;
+ }
+
+@@ -943,6 +924,20 @@ static int usbduxsigma_ao_cmd(struct com
+
+ down(&devpriv->sem);
+
++ if (cmd->convert_src == TRIG_TIMER) {
++ /*
++ * timing of the conversion itself: every 125 us
++ * at high speed (not used yet)
++ */
++ devpriv->ao_timer = cmd->convert_arg / 125000;
++ } else {
++ /*
++ * timing of the scan: every 1ms
++ * we get all channels at once
++ */
++ devpriv->ao_timer = cmd->scan_begin_arg / 1000000;
++ }
++
+ devpriv->ao_counter = devpriv->ao_timer;
+
+ if (cmd->start_src == TRIG_NOW) {
--- /dev/null
+From 435009bba4d0449b611bc24ae5c9636ac5b2a00e Mon Sep 17 00:00:00 2001
+From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
+Date: Wed, 12 Aug 2015 21:54:49 +0200
+Subject: staging: rtl8192e: Fix log spamming in rtl8192_hard_data_xmit
+
+From: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
+
+commit 435009bba4d0449b611bc24ae5c9636ac5b2a00e upstream.
+
+This patch fixes issue generated by commit ca93dcba3a92
+("staging: rtl8192e: Remove assert() macro")
+
+One negation was missed in conversion, therefore
+asserted message was always printed.
+For 1MB file downloaded via http, ~500 messages
+were generated.
+
+Signed-off-by: Mateusz Kulikowski <mateusz.kulikowski@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -1826,8 +1826,8 @@ void rtl8192_hard_data_xmit(struct sk_bu
+ return;
+ }
+
+- if (queue_index != TXCMD_QUEUE)
+- netdev_warn(dev, "%s(): queue index != TXCMD_QUEUE\n",
++ if (queue_index == TXCMD_QUEUE)
++ netdev_warn(dev, "%s(): queue index == TXCMD_QUEUE\n",
+ __func__);
+
+ memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
--- /dev/null
+From 1fc07f99134ba0b8d4099322ea0753137ea7ed3b Mon Sep 17 00:00:00 2001
+From: David Kershner <david.kershner@unisys.com>
+Date: Thu, 9 Jul 2015 13:27:53 -0400
+Subject: staging: unisys: Allow visorbus to autoload
+
+From: David Kershner <david.kershner@unisys.com>
+
+commit 1fc07f99134ba0b8d4099322ea0753137ea7ed3b upstream.
+
+We inadvertently remove the MODULE_DEVICE_TABLE line for visorbus,
+this patch adds it back in.
+
+Signed-off-by: David Kershner <david.kershner@unisys.com>
+Signed-off-by: Benjamin Romer <benjamin.romer@unisys.com>
+Fixes: d5b3f1dccee4 ('staging: unisys: move timskmod.h functionality')
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/unisys/visorbus/visorchipset.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/staging/unisys/visorbus/visorchipset.c
++++ b/drivers/staging/unisys/visorbus/visorchipset.c
+@@ -2381,6 +2381,9 @@ static struct acpi_driver unisys_acpi_dr
+ .remove = visorchipset_exit,
+ },
+ };
++
++MODULE_DEVICE_TABLE(acpi, unisys_device_ids);
++
+ static __init uint32_t visorutil_spar_detect(void)
+ {
+ unsigned int eax, ebx, ecx, edx;
projects / thirdparty / kernel / stable-queue.git / commitdiff
