--- /dev/null
+From 5e6b9a89afceadb1ee45472098f7d20af260335c Mon Sep 17 00:00:00 2001
+From: Alexandre Courbot <acourbot@nvidia.com>
+Date: Fri, 2 Dec 2016 20:57:55 +0100
+Subject: arm64: tegra: Add VDD_GPU regulator to Jetson TX1
+
+From: Alexandre Courbot <acourbot@nvidia.com>
+
+commit 5e6b9a89afceadb1ee45472098f7d20af260335c upstream.
+
+Add the VDD_GPU regulator (a GPIO-enabled PWM regulator) to the Jetson
+TX1 board. This addition allows the GPU to be used provided the
+bootloader properly enabled the GPU node.
+
+Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+[as pointed out by Thierry on IRC, nobody has reported a bug
+ in the field, but using a new bootloader with a .dtb that
+ has the incorrect data, it will crash on boot]
+Fixes: 336f79c7b6d7 ("arm64: tegra: Add NVIDIA Jetson TX1 Developer Kit support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
++++ b/arch/arm64/boot/dts/nvidia/tegra210-p2180.dtsi
+@@ -21,6 +21,10 @@
+ reg = <0x0 0x80000000 0x1 0x0>;
+ };
+
++ gpu@57000000 {
++ vdd-supply = <&vdd_gpu>;
++ };
++
+ /* debug port */
+ serial@70006000 {
+ status = "okay";
+@@ -291,4 +295,18 @@
+ clock-frequency = <32768>;
+ };
+ };
++
++ regulators {
++ vdd_gpu: regulator@100 {
++ compatible = "pwm-regulator";
++ reg = <100>;
++ pwms = <&pwm 1 4880>;
++ regulator-name = "VDD_GPU";
++ regulator-min-microvolt = <710000>;
++ regulator-max-microvolt = <1320000>;
++ enable-gpios = <&pmic 6 GPIO_ACTIVE_HIGH>;
++ regulator-ramp-delay = <80>;
++ regulator-enable-ramp-delay = <1000>;
++ };
++ };
+ };
--- /dev/null
+From 91851cc7a939039bd401adb6ca3da4402bec1d0c Mon Sep 17 00:00:00 2001
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Tue, 15 Nov 2016 18:47:21 +0100
+Subject: ath9k: fix ath9k_hw_gpio_get() to return 0 or 1 on success
+
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+
+commit 91851cc7a939039bd401adb6ca3da4402bec1d0c upstream.
+
+Commit b2d70d4944c1 ("ath9k: make GPIO API to support both of WMAC and
+SOC") refactored ath9k_hw_gpio_get() to support both WMAC and SOC GPIOs,
+changing the return on success from 1 to BIT(gpio). This broke some callers
+like ath_is_rfkill_set(). This doesn't fix any known bug in mainline at the
+moment, but should be fixed anyway.
+
+Instead of fixing all callers, change ath9k_hw_gpio_get() back to only
+return 0 or 1.
+
+Fixes: b2d70d4944c1 ("ath9k: make GPIO API to support both of WMAC and SOC")
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+[kvalo@qca.qualcomm.com: mention that doesn't fix any known bug]
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -2792,7 +2792,7 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah,
+ WARN_ON(1);
+ }
+
+- return val;
++ return !!val;
+ }
+ EXPORT_SYMBOL(ath9k_hw_gpio_get);
+
--- /dev/null
+From 79e57dd113d307a6c74773b8aaecf5442068988a Mon Sep 17 00:00:00 2001
+From: "Vittorio Gambaletta (VittGam)" <linux-wireless@vittgam.net>
+Date: Wed, 9 Nov 2016 03:40:56 +0200
+Subject: ath9k: Really fix LED polarity for some Mini PCI AR9220 MB92 cards.
+
+From: Vittorio Gambaletta (VittGam) <linux-wireless@vittgam.net>
+
+commit 79e57dd113d307a6c74773b8aaecf5442068988a upstream.
+
+The active_high LED of my Wistron DNMA-92 is still being recognized as
+active_low on 4.7.6 mainline. When I was preparing my former commit
+0f9edcdd88a9 ("ath9k: Fix LED polarity for some Mini PCI AR9220 MB92
+cards.") to fix that I must have somehow messed up with testing, because
+I tested the final version of that patch before sending it, and it was
+apparently working; but now it is not working on 4.7.6 mainline.
+
+I initially added the PCI_DEVICE_SUB section for 0x0029/0x2096 above the
+PCI_VDEVICE section for 0x0029; but then I moved the former below the
+latter after seeing how 0x002A sections were sorted in the file.
+
+This turned out to be wrong: if a generic PCI_VDEVICE entry (that has
+both subvendor and subdevice IDs set to PCI_ANY_ID) is put before a more
+specific one (PCI_DEVICE_SUB), then the generic PCI_VDEVICE entry will
+match first and will be used.
+
+With this patch, 0x0029/0x2096 has finally got active_high LED on 4.7.6.
+
+While I'm at it, let's fix 0x002A too by also moving its generic definition
+below its specific ones.
+
+Fixes: 0f9edcdd88a9 ("ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards.")
+Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
+[kvalo@qca.qualcomm.com: improve the commit log based on email discussions]
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/pci.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -26,7 +26,6 @@ static const struct pci_device_id ath_pc
+ { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI */
+ { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
+ { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI */
+- { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */
+
+ #ifdef CONFIG_ATH9K_PCOEM
+ /* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */
+@@ -37,7 +36,7 @@ static const struct pci_device_id ath_pc
+ .driver_data = ATH9K_PCI_LED_ACT_HI },
+ #endif
+
+- { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
++ { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */
+
+ #ifdef CONFIG_ATH9K_PCOEM
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+@@ -85,7 +84,11 @@ static const struct pci_device_id ath_pc
+ 0x10CF, /* Fujitsu */
+ 0x1536),
+ .driver_data = ATH9K_PCI_D3_L1_WAR },
++#endif
+
++ { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
++
++#ifdef CONFIG_ATH9K_PCOEM
+ /* AR9285 card for Asus */
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x002B,
--- /dev/null
+From e6f462df9acd2a3295e5d34eb29e2823220cf129 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 8 Dec 2016 17:22:09 +0100
+Subject: cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit e6f462df9acd2a3295e5d34eb29e2823220cf129 upstream.
+
+When mac80211 abandons an association attempt, it may free
+all the data structures, but inform cfg80211 and userspace
+about it only by sending the deauth frame it received, in
+which case cfg80211 has no link to the BSS struct that was
+used and will not cfg80211_unhold_bss() it.
+
+Fix this by providing a way to inform cfg80211 of this with
+the BSS entry passed, so that it can clean up properly, and
+use this ability in the appropriate places in mac80211.
+
+This isn't ideal: some code is more or less duplicated and
+tracing is missing. However, it's a fairly small change and
+it's thus easier to backport - cleanups can come later.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/cfg80211.h | 11 +++++++++++
+ net/mac80211/mlme.c | 21 ++++++++++++---------
+ net/wireless/core.h | 1 +
+ net/wireless/mlme.c | 12 ++++++++++++
+ net/wireless/sme.c | 14 ++++++++++++++
+ 5 files changed, 50 insertions(+), 9 deletions(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4393,6 +4393,17 @@ void cfg80211_rx_assoc_resp(struct net_d
+ void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
+
+ /**
++ * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt
++ * @dev: network device
++ * @bss: The BSS entry with which association was abandoned.
++ *
++ * Call this whenever - for reasons reported through other API, like deauth RX,
++ * an association attempt was abandoned.
++ * This function may sleep. The caller must hold the corresponding wdev's mutex.
++ */
++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss);
++
++/**
+ * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
+ * @dev: network device
+ * @buf: 802.11 frame (header + body)
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2506,7 +2506,7 @@ static void ieee80211_destroy_auth_data(
+ }
+
+ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
+- bool assoc)
++ bool assoc, bool abandon)
+ {
+ struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
+
+@@ -2529,6 +2529,9 @@ static void ieee80211_destroy_assoc_data
+ mutex_lock(&sdata->local->mtx);
+ ieee80211_vif_release_channel(sdata);
+ mutex_unlock(&sdata->local->mtx);
++
++ if (abandon)
++ cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
+ }
+
+ kfree(assoc_data);
+@@ -2758,7 +2761,7 @@ static void ieee80211_rx_mgmt_deauth(str
+ bssid, reason_code,
+ ieee80211_get_reason_code_string(reason_code));
+
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, true);
+
+ cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+ return;
+@@ -3163,14 +3166,14 @@ static void ieee80211_rx_mgmt_assoc_resp
+ if (status_code != WLAN_STATUS_SUCCESS) {
+ sdata_info(sdata, "%pM denied association (code=%d)\n",
+ mgmt->sa, status_code);
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, false);
+ event.u.mlme.status = MLME_DENIED;
+ event.u.mlme.reason = status_code;
+ drv_event_callback(sdata->local, sdata, &event);
+ } else {
+ if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
+ /* oops -- internal error -- send timeout for now */
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, false);
+ cfg80211_assoc_timeout(sdata->dev, bss);
+ return;
+ }
+@@ -3183,7 +3186,7 @@ static void ieee80211_rx_mgmt_assoc_resp
+ * recalc after assoc_data is NULL but before associated
+ * is set can cause the interface to go idle
+ */
+- ieee80211_destroy_assoc_data(sdata, true);
++ ieee80211_destroy_assoc_data(sdata, true, false);
+
+ /* get uapsd queues configuration */
+ uapsd_queues = 0;
+@@ -3882,7 +3885,7 @@ void ieee80211_sta_work(struct ieee80211
+ .u.mlme.status = MLME_TIMEOUT,
+ };
+
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, false);
+ cfg80211_assoc_timeout(sdata->dev, bss);
+ drv_event_callback(sdata->local, sdata, &event);
+ }
+@@ -4021,7 +4024,7 @@ void ieee80211_mgd_quiesce(struct ieee80
+ WLAN_REASON_DEAUTH_LEAVING,
+ false, frame_buf);
+ if (ifmgd->assoc_data)
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, true);
+ if (ifmgd->auth_data)
+ ieee80211_destroy_auth_data(sdata, false);
+ cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+@@ -4903,7 +4906,7 @@ int ieee80211_mgd_deauth(struct ieee8021
+ IEEE80211_STYPE_DEAUTH,
+ req->reason_code, tx,
+ frame_buf);
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, true);
+ ieee80211_report_disconnect(sdata, frame_buf,
+ sizeof(frame_buf), true,
+ req->reason_code);
+@@ -4978,7 +4981,7 @@ void ieee80211_mgd_stop(struct ieee80211
+ sdata_lock(sdata);
+ if (ifmgd->assoc_data) {
+ struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, false);
+ cfg80211_assoc_timeout(sdata->dev, bss);
+ }
+ if (ifmgd->auth_data)
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -410,6 +410,7 @@ void cfg80211_sme_disassoc(struct wirele
+ void cfg80211_sme_deauth(struct wireless_dev *wdev);
+ void cfg80211_sme_auth_timeout(struct wireless_dev *wdev);
+ void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev);
++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev);
+
+ /* internal helpers */
+ bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_d
+ }
+ EXPORT_SYMBOL(cfg80211_assoc_timeout);
+
++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
++{
++ struct wireless_dev *wdev = dev->ieee80211_ptr;
++ struct wiphy *wiphy = wdev->wiphy;
++
++ cfg80211_sme_abandon_assoc(wdev);
++
++ cfg80211_unhold_bss(bss_from_pub(bss));
++ cfg80211_put_bss(wiphy, bss);
++}
++EXPORT_SYMBOL(cfg80211_abandon_assoc);
++
+ void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
+ {
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -39,6 +39,7 @@ struct cfg80211_conn {
+ CFG80211_CONN_ASSOCIATING,
+ CFG80211_CONN_ASSOC_FAILED,
+ CFG80211_CONN_DEAUTH,
++ CFG80211_CONN_ABANDON,
+ CFG80211_CONN_CONNECTED,
+ } state;
+ u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
+@@ -206,6 +207,8 @@ static int cfg80211_conn_do_work(struct
+ cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+ NULL, 0,
+ WLAN_REASON_DEAUTH_LEAVING, false);
++ /* fall through */
++ case CFG80211_CONN_ABANDON:
+ /* free directly, disconnected event already sent */
+ cfg80211_sme_free(wdev);
+ return 0;
+@@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct w
+ schedule_work(&rdev->conn_work);
+ }
+
++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev)
++{
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
++
++ if (!wdev->conn)
++ return;
++
++ wdev->conn->state = CFG80211_CONN_ABANDON;
++ schedule_work(&rdev->conn_work);
++}
++
+ static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
+ const u8 *ies, size_t ies_len,
+ const u8 **out_ies, size_t *out_ies_len)
--- /dev/null
+From 68af4fa8f39b542a6cde7ac19518d88e9b3099dc Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Thu, 1 Dec 2016 20:27:21 +0100
+Subject: clk: bcm2835: Avoid overwriting the div info when disabling a pll_div clk
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+commit 68af4fa8f39b542a6cde7ac19518d88e9b3099dc upstream.
+
+bcm2835_pll_divider_off() is resetting the divider field in the A2W reg
+to zero when disabling the clock.
+
+Make sure we preserve this value by reading the previous a2w_reg value
+first and ORing the result with A2W_PLL_CHANNEL_DISABLE.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Fixes: 41691b8862e2 ("clk: bcm2835: Add support for programming the audio domain clocks")
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/bcm/clk-bcm2835.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -751,7 +751,9 @@ static void bcm2835_pll_divider_off(stru
+ cprman_write(cprman, data->cm_reg,
+ (cprman_read(cprman, data->cm_reg) &
+ ~data->load_mask) | data->hold_mask);
+- cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE);
++ cprman_write(cprman, data->a2w_reg,
++ cprman_read(cprman, data->a2w_reg) |
++ A2W_PLL_CHANNEL_DISABLE);
+ spin_unlock(&cprman->regs_lock);
+ }
+
--- /dev/null
+From f4e81c529767b9a33d1b27695c54dc84a14af30d Mon Sep 17 00:00:00 2001
+From: Lars-Peter Clausen <lars@metafoo.de>
+Date: Wed, 30 Nov 2016 13:05:21 +0100
+Subject: gpio: chardev: Return error for seek operations
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+commit f4e81c529767b9a33d1b27695c54dc84a14af30d upstream.
+
+The GPIO chardev is used for management tasks (allocating line and event
+handles) and does neither support read() nor write() operations. Hence it
+does not make much sense to allow seek operations.
+
+Currently the chardev uses noop_llseek() for its seek implementation. This
+function does not move the pointer and simply returns the current position
+(always 0 for the GPIO chardev). noop_llseek() is primarily meant for
+devices that can not support seek, but where there might be a user that
+depends on the seek() operation succeeding. For newly added devices that
+can not support seek operations it is recommended to use no_llseek(), which
+will return an error. For more information see commit 6038f373a3dc
+("llseek: automatically add .llseek fop").
+
+Unfortunately this was overlooked when the GPIO chardev ABI was introduced.
+But it is highly unlikely that since then userspace applications have
+appeared that rely on being able to perform non-failing seek operations on
+a GPIO chardev file descriptor. So it should be safe to change from
+noop_llseel() to no_seek(). Also use nonseekable_open() in the chardev
+open() callback to clear the FMODE_SEEK, FMODE_PREAD and FMODE_PWRITE flags
+from the file. Neither of these should be set on a file that does not
+support seek operations.
+
+Fixes: 3c702e9987e2 ("gpio: add a userspace chardev ABI for GPIOs")
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -984,7 +984,8 @@ static int gpio_chrdev_open(struct inode
+ return -ENODEV;
+ get_device(&gdev->dev);
+ filp->private_data = gdev;
+- return 0;
++
++ return nonseekable_open(inode, filp);
+ }
+
+ /**
+@@ -1009,7 +1010,7 @@ static const struct file_operations gpio
+ .release = gpio_chrdev_release,
+ .open = gpio_chrdev_open,
+ .owner = THIS_MODULE,
+- .llseek = noop_llseek,
++ .llseek = no_llseek,
+ .unlocked_ioctl = gpio_ioctl,
+ #ifdef CONFIG_COMPAT
+ .compat_ioctl = gpio_ioctl_compat,
--- /dev/null
+From 61e53bd0047d58caee0c7170613045bf96de4458 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 2 Dec 2016 15:14:20 +0200
+Subject: mmc: sdhci: Fix recovery from tuning timeout
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 61e53bd0047d58caee0c7170613045bf96de4458 upstream.
+
+Clearing the tuning bits should reset the tuning circuit. However there is
+more to do. Reset the command and data lines for good measure, and then
+for eMMC ensure the card is not still trying to process a tuning command by
+sending a stop command.
+
+Note the JEDEC eMMC specification says the stop command (CMD12) can be used
+to stop a tuning command (CMD21) whereas the SD specification is silent on
+the subject with respect to the SD tuning command (CMD19). Considering that
+CMD12 is not a valid SDIO command, the stop command is sent only when the
+tuning command is CMD21 i.e. for eMMC. That addresses cases seen so far
+which have been on eMMC.
+
+Note that this replaces the commit fe5fb2e3b58f ("mmc: sdhci: Reset cmd and
+data circuits after tuning failure") which is being reverted for v4.9+.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Tested-by: Dan O'Donovan <dan@emutex.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2074,7 +2074,27 @@ static int sdhci_execute_tuning(struct m
+ ctrl &= ~SDHCI_CTRL_EXEC_TUNING;
+ sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2);
+
++ sdhci_do_reset(host, SDHCI_RESET_CMD);
++ sdhci_do_reset(host, SDHCI_RESET_DATA);
++
+ err = -EIO;
++
++ if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200)
++ goto out;
++
++ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
++ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
++
++ spin_unlock_irqrestore(&host->lock, flags);
++
++ memset(&cmd, 0, sizeof(cmd));
++ cmd.opcode = MMC_STOP_TRANSMISSION;
++ cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
++ cmd.busy_timeout = 50;
++ mmc_wait_for_cmd(mmc, &cmd, 0);
++
++ spin_lock_irqsave(&host->lock, flags);
++
+ goto out;
+ }
+
--- /dev/null
+From b0c1ef52959582144bbea9a2b37db7f4c9e399f7 Mon Sep 17 00:00:00 2001
+From: Andi Kleen <ak@linux.intel.com>
+Date: Thu, 8 Dec 2016 16:14:17 -0800
+Subject: perf/x86: Fix exclusion of BTS and LBR for Goldmont
+
+From: Andi Kleen <ak@linux.intel.com>
+
+commit b0c1ef52959582144bbea9a2b37db7f4c9e399f7 upstream.
+
+An earlier patch allowed enabling PT and LBR at the same
+time on Goldmont. However it also allowed enabling BTS and LBR
+at the same time, which is still not supported. Fix this by
+bypassing the check only for PT.
+
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: alexander.shishkin@intel.com
+Cc: kan.liang@intel.com
+Fixes: ccbebba4c6bf ("perf/x86/intel/pt: Bypass PT vs. LBR exclusivity if the core supports it")
+Link: http://lkml.kernel.org/r/20161209001417.4713-1-andi@firstfloor.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/core.c | 8 ++++++--
+ arch/x86/events/perf_event.h | 2 +-
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -364,7 +364,11 @@ int x86_add_exclusive(unsigned int what)
+ {
+ int i;
+
+- if (x86_pmu.lbr_pt_coexist)
++ /*
++ * When lbr_pt_coexist we allow PT to coexist with either LBR or BTS.
++ * LBR and BTS are still mutually exclusive.
++ */
++ if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
+ return 0;
+
+ if (!atomic_inc_not_zero(&x86_pmu.lbr_exclusive[what])) {
+@@ -387,7 +391,7 @@ fail_unlock:
+
+ void x86_del_exclusive(unsigned int what)
+ {
+- if (x86_pmu.lbr_pt_coexist)
++ if (x86_pmu.lbr_pt_coexist && what == x86_lbr_exclusive_pt)
+ return;
+
+ atomic_dec(&x86_pmu.lbr_exclusive[what]);
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -601,7 +601,7 @@ struct x86_pmu {
+ u64 lbr_sel_mask; /* LBR_SELECT valid bits */
+ const int *lbr_sel_map; /* lbr_select mappings */
+ bool lbr_double_abort; /* duplicated lbr aborts */
+- bool lbr_pt_coexist; /* LBR may coexist with PT */
++ bool lbr_pt_coexist; /* (LBR|BTS) may coexist with PT */
+
+ /*
+ * Intel PT/LBR/BTS are exclusive
--- /dev/null
+From 834fcd298003c10ce450e66960c78893cb1cc4b5 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Thu, 22 Dec 2016 11:02:08 +0100
+Subject: perf/x86/intel/cstate: Prevent hotplug callback leak
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 834fcd298003c10ce450e66960c78893cb1cc4b5 upstream.
+
+If the pmu registration fails the registered hotplug callbacks are not
+removed. Wrong in any case, but fatal in case of a modular driver.
+
+Replace the nonsensical state names with proper ones while at it.
+
+Fixes: 77c34ef1c319 ("perf/x86/intel/cstate: Convert Intel CSTATE to hotplug state machine")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Sebastian Siewior <bigeasy@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/intel/cstate.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -571,6 +571,9 @@ static int __init cstate_probe(const str
+
+ static inline void cstate_cleanup(void)
+ {
++ cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE);
++ cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING);
++
+ if (has_cstate_core)
+ perf_pmu_unregister(&cstate_core_pmu);
+
+@@ -583,16 +586,16 @@ static int __init cstate_init(void)
+ int err;
+
+ cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_STARTING,
+- "AP_PERF_X86_CSTATE_STARTING", cstate_cpu_init,
+- NULL);
++ "perf/x86/cstate:starting", cstate_cpu_init, NULL);
+ cpuhp_setup_state(CPUHP_AP_PERF_X86_CSTATE_ONLINE,
+- "AP_PERF_X86_CSTATE_ONLINE", NULL, cstate_cpu_exit);
++ "perf/x86/cstate:online", NULL, cstate_cpu_exit);
+
+ if (has_cstate_core) {
+ err = perf_pmu_register(&cstate_core_pmu, cstate_core_pmu.name, -1);
+ if (err) {
+ has_cstate_core = false;
+ pr_info("Failed to register cstate core pmu\n");
++ cstate_cleanup();
+ return err;
+ }
+ }
+@@ -606,8 +609,7 @@ static int __init cstate_init(void)
+ return err;
+ }
+ }
+-
+- return err;
++ return 0;
+ }
+
+ static int __init cstate_pmu_init(void)
+@@ -632,8 +634,6 @@ module_init(cstate_pmu_init);
+
+ static void __exit cstate_pmu_exit(void)
+ {
+- cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_ONLINE);
+- cpuhp_remove_state_nocalls(CPUHP_AP_PERF_X86_CSTATE_STARTING);
+ cstate_cleanup();
+ }
+ module_exit(cstate_pmu_exit);
--- /dev/null
+From 295070e9aa015abb9b92cccfbb1e43954e938133 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sat, 12 Nov 2016 15:22:38 +0100
+Subject: regulator: stw481x-vmmc: fix ages old enable error
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 295070e9aa015abb9b92cccfbb1e43954e938133 upstream.
+
+The regulator has never been properly enabled, it has been
+dormant all the time. It's strange that MMC was working
+at all, but it likely worked by the signals going through
+the levelshifter and reaching the card anyways.
+
+Fixes: 3615a34ea1a6 ("regulator: add STw481x VMMC driver")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/stw481x-vmmc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/stw481x-vmmc.c
++++ b/drivers/regulator/stw481x-vmmc.c
+@@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regula
+ .volt_table = stw481x_vmmc_voltages,
+ .enable_time = 200, /* FIXME: look this up */
+ .enable_reg = STW_CONF1,
+- .enable_mask = STW_CONF1_PDN_VMMC,
++ .enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS,
++ .enable_val = STW_CONF1_PDN_VMMC,
+ .vsel_reg = STW_CONF1,
+ .vsel_mask = STW_CONF1_VMMC_MASK,
+ };
--- /dev/null
+From c59f13bbead475096bdfebc7ef59c12e180858de Mon Sep 17 00:00:00 2001
+From: Jes Sorensen <Jes.Sorensen@redhat.com>
+Date: Tue, 29 Nov 2016 18:59:02 -0500
+Subject: rtl8xxxu: Work around issue with 8192eu and 8723bu devices not reconnecting
+
+From: Jes Sorensen <Jes.Sorensen@redhat.com>
+
+commit c59f13bbead475096bdfebc7ef59c12e180858de upstream.
+
+The H2C MEDIA_STATUS_RPT command for some reason causes 8192eu and
+8723bu devices not being able to reconnect.
+
+Reported-by: Barry Day <briselec@gmail.com>
+Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+@@ -4401,6 +4401,13 @@ void rtl8xxxu_gen1_report_connect(struct
+ void rtl8xxxu_gen2_report_connect(struct rtl8xxxu_priv *priv,
+ u8 macid, bool connect)
+ {
++#ifdef RTL8XXXU_GEN2_REPORT_CONNECT
++ /*
++ * Barry Day reports this causes issues with 8192eu and 8723bu
++ * devices reconnecting. The reason for this is unclear, but
++ * until it is better understood, leave the code in place but
++ * disabled, so it is not lost.
++ */
+ struct h2c_cmd h2c;
+
+ memset(&h2c, 0, sizeof(struct h2c_cmd));
+@@ -4412,6 +4419,7 @@ void rtl8xxxu_gen2_report_connect(struct
+ h2c.media_status_rpt.parm &= ~BIT(0);
+
+ rtl8xxxu_gen2_h2c_cmd(priv, &h2c, sizeof(h2c.media_status_rpt));
++#endif
+ }
+
+ void rtl8xxxu_gen1_init_aggregation(struct rtl8xxxu_priv *priv)
--- /dev/null
+From ba9f93f82abafe2552eac942ebb11c2df4f8dd7f Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 26 Nov 2016 14:43:35 -0600
+Subject: rtlwifi: Fix enter/exit power_save
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit ba9f93f82abafe2552eac942ebb11c2df4f8dd7f upstream.
+
+In commit a5ffbe0a1993 ("rtlwifi: Fix scheduling while atomic bug") and
+commit a269913c52ad ("rtlwifi: Rework rtl_lps_leave() and rtl_lps_enter()
+to use work queue"), an error was introduced in the power-save routines
+due to the fact that leaving PS was delayed by the use of a work queue.
+
+This problem is fixed by detecting if the enter or leave routines are
+in interrupt mode. If so, the workqueue is used to place the request.
+If in normal mode, the enter or leave routines are called directly.
+
+Fixes: a269913c52ad ("rtlwifi: Rework rtl_lps_leave() and rtl_lps_enter() to use work queue")
+Reported-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 8 +++---
+ drivers/net/wireless/realtek/rtlwifi/core.c | 9 ++-----
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 14 +++-------
+ drivers/net/wireless/realtek/rtlwifi/ps.c | 36 +++++++++++++++++++++-------
+ 4 files changed, 40 insertions(+), 27 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -1303,12 +1303,13 @@ EXPORT_SYMBOL_GPL(rtl_action_proc);
+
+ static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc)
+ {
++ struct ieee80211_hw *hw = rtlpriv->hw;
++
+ rtlpriv->ra.is_special_data = true;
+ if (rtlpriv->cfg->ops->get_btc_status())
+ rtlpriv->btcoexist.btc_ops->btc_special_packet_notify(
+ rtlpriv, 1);
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
++ rtl_lps_leave(hw);
+ ppsc->last_delaylps_stamp_jiffies = jiffies;
+ }
+
+@@ -1381,8 +1382,7 @@ u8 rtl_is_special_data(struct ieee80211_
+
+ if (is_tx) {
+ rtlpriv->ra.is_special_data = true;
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
++ rtl_lps_leave(hw);
+ ppsc->last_delaylps_stamp_jiffies = jiffies;
+ }
+
+--- a/drivers/net/wireless/realtek/rtlwifi/core.c
++++ b/drivers/net/wireless/realtek/rtlwifi/core.c
+@@ -1149,10 +1149,8 @@ static void rtl_op_bss_info_changed(stru
+ } else {
+ mstatus = RT_MEDIA_DISCONNECT;
+
+- if (mac->link_state == MAC80211_LINKED) {
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
+- }
++ if (mac->link_state == MAC80211_LINKED)
++ rtl_lps_leave(hw);
+ if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE)
+ rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
+ mac->link_state = MAC80211_NOLINK;
+@@ -1430,8 +1428,7 @@ static void rtl_op_sw_scan_start(struct
+ }
+
+ if (mac->link_state == MAC80211_LINKED) {
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
++ rtl_lps_leave(hw);
+ mac->link_state = MAC80211_LINKED_SCANNING;
+ } else {
+ rtl_ips_nic_on(hw);
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -662,11 +662,9 @@ tx_status_ok:
+ }
+
+ if (((rtlpriv->link_info.num_rx_inperiod +
+- rtlpriv->link_info.num_tx_inperiod) > 8) ||
+- (rtlpriv->link_info.num_rx_inperiod > 2)) {
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
+- }
++ rtlpriv->link_info.num_tx_inperiod) > 8) ||
++ (rtlpriv->link_info.num_rx_inperiod > 2))
++ rtl_lps_leave(hw);
+ }
+
+ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+@@ -917,10 +915,8 @@ new_trx_end:
+ }
+ if (((rtlpriv->link_info.num_rx_inperiod +
+ rtlpriv->link_info.num_tx_inperiod) > 8) ||
+- (rtlpriv->link_info.num_rx_inperiod > 2)) {
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
+- }
++ (rtlpriv->link_info.num_rx_inperiod > 2))
++ rtl_lps_leave(hw);
+ skb = new_skb;
+ no_new:
+ if (rtlpriv->use_new_trx_flow) {
+--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
+@@ -407,8 +407,8 @@ void rtl_lps_set_psmode(struct ieee80211
+ }
+ }
+
+-/*Enter the leisure power save mode.*/
+-void rtl_lps_enter(struct ieee80211_hw *hw)
++/* Interrupt safe routine to enter the leisure power save mode.*/
++static void rtl_lps_enter_core(struct ieee80211_hw *hw)
+ {
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+ struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+@@ -444,10 +444,9 @@ void rtl_lps_enter(struct ieee80211_hw *
+
+ spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
+ }
+-EXPORT_SYMBOL(rtl_lps_enter);
+
+-/*Leave the leisure power save mode.*/
+-void rtl_lps_leave(struct ieee80211_hw *hw)
++/* Interrupt safe routine to leave the leisure power save mode.*/
++static void rtl_lps_leave_core(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+@@ -477,7 +476,6 @@ void rtl_lps_leave(struct ieee80211_hw *
+ }
+ spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
+ }
+-EXPORT_SYMBOL(rtl_lps_leave);
+
+ /* For sw LPS*/
+ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
+@@ -670,12 +668,34 @@ void rtl_lps_change_work_callback(struct
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+ if (rtlpriv->enter_ps)
+- rtl_lps_enter(hw);
++ rtl_lps_enter_core(hw);
+ else
+- rtl_lps_leave(hw);
++ rtl_lps_leave_core(hw);
+ }
+ EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
+
++void rtl_lps_enter(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++
++ if (!in_interrupt())
++ return rtl_lps_enter_core(hw);
++ rtlpriv->enter_ps = true;
++ schedule_work(&rtlpriv->works.lps_change_work);
++}
++EXPORT_SYMBOL_GPL(rtl_lps_enter);
++
++void rtl_lps_leave(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++
++ if (!in_interrupt())
++ return rtl_lps_leave_core(hw);
++ rtlpriv->enter_ps = false;
++ schedule_work(&rtlpriv->works.lps_change_work);
++}
++EXPORT_SYMBOL_GPL(rtl_lps_leave);
++
+ void rtl_swlps_wq_callback(void *data)
+ {
+ struct rtl_works *rtlworks = container_of_dwork_rtl(data,
--- /dev/null
+From 8052d7245b6089992343c80b38b14dbbd8354651 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 5 Nov 2016 14:08:57 -0500
+Subject: ssb: Fix error routine when fallback SPROM fails
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 8052d7245b6089992343c80b38b14dbbd8354651 upstream.
+
+When there is a CRC error in the SPROM read from the device, the code
+attempts to handle a fallback SPROM. When this also fails, the driver
+returns zero rather than an error code.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ssb/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_
+ if (err) {
+ ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n",
+ err);
++ goto out_free;
+ } else {
+ ssb_dbg("Using SPROM revision %d provided by platform\n",
+ sprom->revision);
--- /dev/null
+From f37fabb8643eaf8e3b613333a72f683770c85eca Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Tue, 22 Nov 2016 19:22:44 +0200
+Subject: thermal: hwmon: Properly report critical temperature in sysfs
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit f37fabb8643eaf8e3b613333a72f683770c85eca upstream.
+
+In the critical sysfs entry the thermal hwmon was returning wrong
+temperature to the user-space. It was reporting the temperature of the
+first trip point instead of the temperature of critical trip point.
+
+For example:
+ /sys/class/hwmon/hwmon0/temp1_crit:50000
+ /sys/class/thermal/thermal_zone0/trip_point_0_temp:50000
+ /sys/class/thermal/thermal_zone0/trip_point_0_type:active
+ /sys/class/thermal/thermal_zone0/trip_point_3_temp:120000
+ /sys/class/thermal/thermal_zone0/trip_point_3_type:critical
+
+Since commit e68b16abd91d ("thermal: add hwmon sysfs I/F") the driver
+have been registering a sysfs entry if get_crit_temp() callback was
+provided. However when accessed, it was calling get_trip_temp() instead
+of the get_crit_temp().
+
+Fixes: e68b16abd91d ("thermal: add hwmon sysfs I/F")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/thermal/thermal_hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/thermal/thermal_hwmon.c
++++ b/drivers/thermal/thermal_hwmon.c
+@@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struc
+ int temperature;
+ int ret;
+
+- ret = tz->ops->get_trip_temp(tz, 0, &temperature);
++ ret = tz->ops->get_crit_temp(tz, &temperature);
+ if (ret)
+ return ret;
+
--- /dev/null
+From 9c1645727b8fa90d07256fdfcc45bf831242a3ab Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Thu, 8 Dec 2016 20:49:32 +0000
+Subject: timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 9c1645727b8fa90d07256fdfcc45bf831242a3ab upstream.
+
+The clocksource delta to nanoseconds conversion is using signed math, but
+the delta is unsigned. This makes the conversion space smaller than
+necessary and in case of a multiplication overflow the conversion can
+become negative. The conversion is done with scaled math:
+
+ s64 nsec_delta = ((s64)clkdelta * clk->mult) >> clk->shift;
+
+Shifting a signed integer right obvioulsy preserves the sign, which has
+interesting consequences:
+
+ - Time jumps backwards
+
+ - __iter_div_u64_rem() which is used in one of the calling code pathes
+ will take forever to piecewise calculate the seconds/nanoseconds part.
+
+This has been reported by several people with different scenarios:
+
+David observed that when stopping a VM with a debugger:
+
+ "It was essentially the stopped by debugger case. I forget exactly why,
+ but the guest was being explicitly stopped from outside, it wasn't just
+ scheduling lag. I think it was something in the vicinity of 10 minutes
+ stopped."
+
+ When lifting the stop the machine went dead.
+
+The stopped by debugger case is not really interesting, but nevertheless it
+would be a good thing not to die completely.
+
+But this was also observed on a live system by Liav:
+
+ "When the OS is too overloaded, delta will get a high enough value for the
+ msb of the sum delta * tkr->mult + tkr->xtime_nsec to be set, and so
+ after the shift the nsec variable will gain a value similar to
+ 0xffffffffff000000."
+
+Unfortunately this has been reintroduced recently with commit 6bd58f09e1d8
+("time: Add cycles to nanoseconds translation"). It had been fixed a year
+ago already in commit 35a4933a8959 ("time: Avoid signed overflow in
+timekeeping_get_ns()").
+
+Though it's not surprising that the issue has been reintroduced because the
+function itself and the whole call chain uses s64 for the result and the
+propagation of it. The change in this recent commit is subtle:
+
+ s64 nsec;
+
+- nsec = (d * m + n) >> s:
++ nsec = d * m + n;
++ nsec >>= s;
+
+d being type of cycle_t adds another level of obfuscation.
+
+This wouldn't have happened if the previous change to unsigned computation
+would have made the 'nsec' variable u64 right away and a follow up patch
+had cleaned up the whole call chain.
+
+There have been patches submitted which basically did a revert of the above
+patch leaving everything else unchanged as signed. Back to square one. This
+spawned a admittedly pointless discussion about potential users which rely
+on the unsigned behaviour until someone pointed out that it had been fixed
+before. The changelogs of said patches added further confusion as they made
+finally false claims about the consequences for eventual users which expect
+signed results.
+
+Despite delta being cycle_t, aka. u64, it's very well possible to hand in
+a signed negative value and the signed computation will happily return the
+correct result. But nobody actually sat down and analyzed the code which
+was added as user after the propably unintended signed conversion.
+
+Though in sensitive code like this it's better to analyze it proper and
+make sure that nothing relies on this than hunting the subtle wreckage half
+a year later. After analyzing all call chains it stands that no caller can
+hand in a negative value (which actually would work due to the s64 cast)
+and rely on the signed math to do the right thing.
+
+Change the conversion function to unsigned math. The conversion of all call
+chains is done in a follow up patch.
+
+This solves the starvation issue, which was caused by the negative result,
+but it does not solve the underlying problem. It merily procrastinates
+it. When the timekeeper update is deferred long enough that the unsigned
+multiplication overflows, then time going backwards is observable again.
+
+It does neither solve the issue of clocksources with a small counter width
+which will wrap around possibly several times and cause random time stamps
+to be generated. But those are usually not found on systems used for
+virtualization, so this is likely a non issue.
+
+I took the liberty to claim authorship for this simply because
+analyzing all callsites and writing the changelog took substantially
+more time than just making the simple s/s64/u64/ change and ignore the
+rest.
+
+Fixes: 6bd58f09e1d8 ("time: Add cycles to nanoseconds translation")
+Reported-by: David Gibson <david@gibson.dropbear.id.au>
+Reported-by: Liav Rehana <liavr@mellanox.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Parit Bhargava <prarit@redhat.com>
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: "Christopher S. Hall" <christopher.s.hall@intel.com>
+Cc: Chris Metcalf <cmetcalf@mellanox.com>
+Cc: Richard Cochran <richardcochran@gmail.com>
+Cc: John Stultz <john.stultz@linaro.org>
+Link: http://lkml.kernel.org/r/20161208204228.688545601@linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/timekeeping.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -299,10 +299,10 @@ u32 (*arch_gettimeoffset)(void) = defaul
+ static inline u32 arch_gettimeoffset(void) { return 0; }
+ #endif
+
+-static inline s64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
++static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
+ cycle_t delta)
+ {
+- s64 nsec;
++ u64 nsec;
+
+ nsec = delta * tkr->mult + tkr->xtime_nsec;
+ nsec >>= tkr->shift;
projects / thirdparty / kernel / stable-queue.git / commitdiff
