--- /dev/null
+From 753246840d012ae34ea80a1d40bc1546c62fb957 Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Sat, 27 Aug 2016 16:19:49 +0000
+Subject: drivers/perf: arm_pmu: Fix leak in error path
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+commit 753246840d012ae34ea80a1d40bc1546c62fb957 upstream.
+
+In case of a IRQ type mismatch in of_pmu_irq_cfg() the
+device node for interrupt affinity isn't freed. So fix this
+issue by calling of_node_put().
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: fa8ad7889d83 ("arm: perf: factor arm_pmu core out to drivers")
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/perf/arm_pmu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/perf/arm_pmu.c
++++ b/drivers/perf/arm_pmu.c
+@@ -921,6 +921,7 @@ static int of_pmu_irq_cfg(struct arm_pmu
+ if (i > 0 && spi != using_spi) {
+ pr_err("PPI/SPI IRQ type mismatch for %s!\n",
+ dn->name);
++ of_node_put(dn);
+ kfree(irqs);
+ return -EINVAL;
+ }
--- /dev/null
+From e35478eac030990e23a56bf11dc074c5a069124a Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Tue, 23 Aug 2016 17:28:03 +0200
+Subject: i2c: mux: demux-pinctrl: run properly with multiple instances
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit e35478eac030990e23a56bf11dc074c5a069124a upstream.
+
+We can't use a static property for all the changesets, so we now create
+dynamic ones for each changeset.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Fixes: 50a5ba87690814 ("i2c: mux: demux-pinctrl: add driver")
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/muxes/i2c-demux-pinctrl.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -37,8 +37,6 @@ struct i2c_demux_pinctrl_priv {
+ struct i2c_demux_pinctrl_chan chan[];
+ };
+
+-static struct property status_okay = { .name = "status", .length = 3, .value = "ok" };
+-
+ static int i2c_demux_master_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
+ {
+ struct i2c_demux_pinctrl_priv *priv = adap->algo_data;
+@@ -192,6 +190,7 @@ static int i2c_demux_pinctrl_probe(struc
+ {
+ struct device_node *np = pdev->dev.of_node;
+ struct i2c_demux_pinctrl_priv *priv;
++ struct property *props;
+ int num_chan, i, j, err;
+
+ num_chan = of_count_phandle_with_args(np, "i2c-parent", NULL);
+@@ -202,7 +201,10 @@ static int i2c_demux_pinctrl_probe(struc
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv)
+ + num_chan * sizeof(struct i2c_demux_pinctrl_chan), GFP_KERNEL);
+- if (!priv)
++
++ props = devm_kcalloc(&pdev->dev, num_chan, sizeof(*props), GFP_KERNEL);
++
++ if (!priv || !props)
+ return -ENOMEM;
+
+ err = of_property_read_string(np, "i2c-bus-name", &priv->bus_name);
+@@ -220,8 +222,12 @@ static int i2c_demux_pinctrl_probe(struc
+ }
+ priv->chan[i].parent_np = adap_np;
+
++ props[i].name = devm_kstrdup(&pdev->dev, "status", GFP_KERNEL);
++ props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL);
++ props[i].length = 3;
++
+ of_changeset_init(&priv->chan[i].chgset);
+- of_changeset_update_property(&priv->chan[i].chgset, adap_np, &status_okay);
++ of_changeset_update_property(&priv->chan[i].chgset, adap_np, &props[i]);
+ }
+
+ priv->num_chan = num_chan;
--- /dev/null
+From cd956722167ba4fdba9c1ce3eed251b04ea2e10f Mon Sep 17 00:00:00 2001
+From: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Date: Tue, 17 May 2016 22:41:33 +0200
+Subject: i40e: avoid null pointer dereference
+
+From: Heinrich Schuchardt <xypron.glpk@gmx.de>
+
+commit cd956722167ba4fdba9c1ce3eed251b04ea2e10f upstream.
+
+In function i40e_debug_aq parameter desc is assumed to be
+possibly NULL. Do not dereference it before checking the
+value.
+
+Fixes: f905dd62be88 ("i40e/i40evf: add max buf len to aq debug print helper")
+Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -297,13 +297,15 @@ void i40e_debug_aq(struct i40e_hw *hw, e
+ void *buffer, u16 buf_len)
+ {
+ struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc;
+- u16 len = le16_to_cpu(aq_desc->datalen);
++ u16 len;
+ u8 *buf = (u8 *)buffer;
+ u16 i = 0;
+
+ if ((!(mask & hw->debug_mask)) || (desc == NULL))
+ return;
+
++ len = le16_to_cpu(aq_desc->datalen);
++
+ i40e_debug(hw, mask,
+ "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n",
+ le16_to_cpu(aq_desc->opcode),
--- /dev/null
+From 3fdbda446fbcd7fb750179c01338e81cf04e46c7 Mon Sep 17 00:00:00 2001
+From: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Date: Wed, 18 May 2016 01:01:58 +0200
+Subject: mwifiex: illegal assignment
+
+From: Heinrich Schuchardt <xypron.glpk@gmx.de>
+
+commit 3fdbda446fbcd7fb750179c01338e81cf04e46c7 upstream.
+
+Variable adapter is incorrectly initialized.
+
+Fixes: bf00dc22bc7a ("mwifiex: AMSDU Rx frame handling in AP mode")
+Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Acked-by: Amitkumar Karwar <akarwar@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
++++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+@@ -272,7 +272,7 @@ int mwifiex_handle_uap_rx_forward(struct
+ int mwifiex_uap_recv_packet(struct mwifiex_private *priv,
+ struct sk_buff *skb)
+ {
+- struct mwifiex_adapter *adapter = adapter;
++ struct mwifiex_adapter *adapter = priv->adapter;
+ struct mwifiex_sta_node *src_node;
+ struct ethhdr *p_ethhdr;
+ struct sk_buff *skb_uap;
--- /dev/null
+From 8b6a3fe8fab97716990a3abde1a01fb5a34552a3 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Wed, 24 Aug 2016 10:07:14 +0100
+Subject: perf/core: Use this_cpu_ptr() when stopping AUX events
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 8b6a3fe8fab97716990a3abde1a01fb5a34552a3 upstream.
+
+When tearing down an AUX buf for an event via perf_mmap_close(),
+__perf_event_output_stop() is called on the event's CPU to ensure that
+trace generation is halted before the process of unmapping and
+freeing the buffer pages begins.
+
+The callback is performed via cpu_function_call(), which ensures that it
+runs with interrupts disabled and is therefore not preemptible.
+Unfortunately, the current code grabs the per-cpu context pointer using
+get_cpu_ptr(), which unnecessarily disables preemption and doesn't pair
+the call with put_cpu_ptr(), leading to a preempt_count() imbalance and
+a BUG when freeing the AUX buffer later on:
+
+ WARNING: CPU: 1 PID: 2249 at kernel/events/ring_buffer.c:539 __rb_free_aux+0x10c/0x120
+ Modules linked in:
+ [...]
+ Call Trace:
+ [<ffffffff813379dd>] dump_stack+0x4f/0x72
+ [<ffffffff81059ff6>] __warn+0xc6/0xe0
+ [<ffffffff8105a0c8>] warn_slowpath_null+0x18/0x20
+ [<ffffffff8112761c>] __rb_free_aux+0x10c/0x120
+ [<ffffffff81128163>] rb_free_aux+0x13/0x20
+ [<ffffffff8112515e>] perf_mmap_close+0x29e/0x2f0
+ [<ffffffff8111da30>] ? perf_iterate_ctx+0xe0/0xe0
+ [<ffffffff8115f685>] remove_vma+0x25/0x60
+ [<ffffffff81161796>] exit_mmap+0x106/0x140
+ [<ffffffff8105725c>] mmput+0x1c/0xd0
+ [<ffffffff8105cac3>] do_exit+0x253/0xbf0
+ [<ffffffff8105e32e>] do_group_exit+0x3e/0xb0
+ [<ffffffff81068d49>] get_signal+0x249/0x640
+ [<ffffffff8101c273>] do_signal+0x23/0x640
+ [<ffffffff81905f42>] ? _raw_write_unlock_irq+0x12/0x30
+ [<ffffffff81905f69>] ? _raw_spin_unlock_irq+0x9/0x10
+ [<ffffffff81901896>] ? __schedule+0x2c6/0x710
+ [<ffffffff810022a4>] exit_to_usermode_loop+0x74/0x90
+ [<ffffffff81002a56>] prepare_exit_to_usermode+0x26/0x30
+ [<ffffffff81906d1b>] retint_user+0x8/0x10
+
+This patch uses this_cpu_ptr() instead of get_cpu_ptr(), since preemption is
+already disabled by the caller.
+
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Reviewed-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Fixes: 95ff4ca26c49 ("perf/core: Free AUX pages in unmap path")
+Link: http://lkml.kernel.org/r/20160824091905.GA16944@arm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6064,7 +6064,7 @@ static int __perf_pmu_output_stop(void *
+ {
+ struct perf_event *event = info;
+ struct pmu *pmu = event->pmu;
+- struct perf_cpu_context *cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
++ struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
+ struct remote_output ro = {
+ .rb = event->rb,
+ };
--- /dev/null
+From 7440926ed9623dceca3310c5f437d06c859dc02b Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 21 Jun 2016 01:40:48 +0300
+Subject: pinctrl: Flag strict is a field in struct pinmux_ops
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 7440926ed9623dceca3310c5f437d06c859dc02b upstream.
+
+Documentation incorrectly refers to struct pinctrl_desc, where no such flag is
+available. Replace the name of the struct.
+
+Fixes: commit 8c4c2016345f ("pinctrl: move strict option to pinmux_ops")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/pinctrl.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -831,7 +831,7 @@ separate memory range only intended for
+ range dealing with pin config and pin multiplexing get placed into a
+ different memory range and a separate section of the data sheet.
+
+-A flag "strict" in struct pinctrl_desc is available to check and deny
++A flag "strict" in struct pinmux_ops is available to check and deny
+ simultaneous access to the same pin from GPIO and pin multiplexing
+ consumers on hardware of this type. The pinctrl driver should set this flag
+ accordingly.
--- /dev/null
+From 10ef8277ec658bf6619da9b3fd65c2db7353c2a4 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 31 May 2016 15:30:10 +0900
+Subject: pinctrl: uniphier: fix .pin_dbg_show() callback
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+commit 10ef8277ec658bf6619da9b3fd65c2db7353c2a4 upstream.
+
+Without this, reading the "pins" in the debugfs causes kernel BUG.
+
+Fixes: 6e9088920258 ("pinctrl: UniPhier: add UniPhier pinctrl core support")
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/uniphier/pinctrl-uniphier-core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
++++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
+@@ -73,6 +73,12 @@ static void uniphier_pctl_pin_dbg_show(s
+ case UNIPHIER_PIN_PULL_DOWN:
+ pull_dir = "DOWN";
+ break;
++ case UNIPHIER_PIN_PULL_UP_FIXED:
++ pull_dir = "UP(FIXED)";
++ break;
++ case UNIPHIER_PIN_PULL_DOWN_FIXED:
++ pull_dir = "DOWN(FIXED)";
++ break;
+ case UNIPHIER_PIN_PULL_NONE:
+ pull_dir = "NONE";
+ break;
--- /dev/null
+From af06d4f74a7d2132c805339bfd5ab771b5706f42 Mon Sep 17 00:00:00 2001
+From: Boqun Feng <boqun.feng@gmail.com>
+Date: Wed, 25 May 2016 09:25:33 +0800
+Subject: rcuperf: Don't treat gp_exp mis-setting as a WARN
+
+From: Boqun Feng <boqun.feng@gmail.com>
+
+commit af06d4f74a7d2132c805339bfd5ab771b5706f42 upstream.
+
+0day found a boot warning triggered in rcu_perf_writer() on !SMP kernel:
+
+ WARN_ON(rcu_gp_is_normal() && gp_exp);
+
+, the root cause of which is trying to measure expedited grace
+periods(by setting gp_exp to true by default) when all the grace periods
+are normal(TINY RCU only has normal grace periods).
+
+However, such a mis-setting would only result in failing to measure the
+performance for a specific kind of grace periods, therefore using a
+WARN_ON to check this is a little overkilling. We could handle this
+inside rcuperf module via some error messages to tell users about the
+mis-settings.
+
+Therefore this patch removes the WARN_ON in rcu_perf_writer() and
+handles those checkings in rcu_perf_init() with plain if() code.
+
+Moreover, this patch changes the default value of gp_exp to 1) align
+with rcutorture tests and 2) make the default setting work for all RCU
+implementations by default.
+
+Suggested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
+Fixes: http://lkml.kernel.org/r/57411b10.mFvG0+AgcrMXGtcj%fengguang.wu@intel.com
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/rcu/rcuperf.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/kernel/rcu/rcuperf.c
++++ b/kernel/rcu/rcuperf.c
+@@ -58,7 +58,7 @@ MODULE_AUTHOR("Paul E. McKenney <paulmck
+ #define VERBOSE_PERFOUT_ERRSTRING(s) \
+ do { if (verbose) pr_alert("%s" PERF_FLAG "!!! %s\n", perf_type, s); } while (0)
+
+-torture_param(bool, gp_exp, true, "Use expedited GP wait primitives");
++torture_param(bool, gp_exp, false, "Use expedited GP wait primitives");
+ torture_param(int, holdoff, 10, "Holdoff time before test start (s)");
+ torture_param(int, nreaders, -1, "Number of RCU reader threads");
+ torture_param(int, nwriters, -1, "Number of RCU updater threads");
+@@ -363,8 +363,6 @@ rcu_perf_writer(void *arg)
+ u64 *wdpp = writer_durations[me];
+
+ VERBOSE_PERFOUT_STRING("rcu_perf_writer task started");
+- WARN_ON(rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp);
+- WARN_ON(rcu_gp_is_normal() && gp_exp);
+ WARN_ON(!wdpp);
+ set_cpus_allowed_ptr(current, cpumask_of(me % nr_cpu_ids));
+ sp.sched_priority = 1;
+@@ -631,6 +629,16 @@ rcu_perf_init(void)
+ firsterr = -ENOMEM;
+ goto unwind;
+ }
++ if (rcu_gp_is_expedited() && !rcu_gp_is_normal() && !gp_exp) {
++ VERBOSE_PERFOUT_ERRSTRING("All grace periods expedited, no normal ones to measure!");
++ firsterr = -EINVAL;
++ goto unwind;
++ }
++ if (rcu_gp_is_normal() && gp_exp) {
++ VERBOSE_PERFOUT_ERRSTRING("All grace periods normal, no expedited ones to measure!");
++ firsterr = -EINVAL;
++ goto unwind;
++ }
+ for (i = 0; i < nrealwriters; i++) {
+ writer_durations[i] =
+ kcalloc(MAX_MEAS, sizeof(*writer_durations[i]),
drm-radeon-si-dpm-add-workaround-for-for-jet-parts.patch
arm-8616-1-dt-respect-property-size-when-parsing-cpus.patch
arm-8617-1-dma-fix-dma_max_pfn.patch
+mwifiex-illegal-assignment.patch
+i40e-avoid-null-pointer-dereference.patch
+pinctrl-uniphier-fix-.pin_dbg_show-callback.patch
+pinctrl-flag-strict-is-a-field-in-struct-pinmux_ops.patch
+i2c-mux-demux-pinctrl-run-properly-with-multiple-instances.patch
+rcuperf-don-t-treat-gp_exp-mis-setting-as-a-warn.patch
+drivers-perf-arm_pmu-fix-leak-in-error-path.patch
+perf-core-use-this_cpu_ptr-when-stopping-aux-events.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
