--- /dev/null
+From fa00c437eef8dc2e7b25f8cd868cfa405fcc2bb3 Mon Sep 17 00:00:00 2001
+From: Dave Carroll <david.carroll@microsemi.com>
+Date: Fri, 5 Aug 2016 13:44:10 -0600
+Subject: aacraid: Check size values after double-fetch from user
+
+From: Dave Carroll <david.carroll@microsemi.com>
+
+commit fa00c437eef8dc2e7b25f8cd868cfa405fcc2bb3 upstream.
+
+In aacraid's ioctl_send_fib() we do two fetches from userspace, one the
+get the fib header's size and one for the fib itself. Later we use the
+size field from the second fetch to further process the fib. If for some
+reason the size from the second fetch is different than from the first
+fix, we may encounter an out-of- bounds access in aac_fib_send(). We
+also check the sender size to insure it is not out of bounds. This was
+reported in https://bugzilla.kernel.org/show_bug.cgi?id=116751 and was
+assigned CVE-2016-6480.
+
+Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
+Fixes: 7c00ffa31 '[SCSI] 2.6 aacraid: Variable FIB size (updated patch)'
+Signed-off-by: Dave Carroll <david.carroll@microsemi.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/aacraid/commctrl.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/aacraid/commctrl.c
++++ b/drivers/scsi/aacraid/commctrl.c
+@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev
+ struct fib *fibptr;
+ struct hw_fib * hw_fib = (struct hw_fib *)0;
+ dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
+- unsigned size;
++ unsigned int size, osize;
+ int retval;
+
+ if (dev->in_reset) {
+@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev
+ * will not overrun the buffer when we copy the memory. Return
+ * an error if we would.
+ */
+- size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
++ osize = size = le16_to_cpu(kfib->header.Size) +
++ sizeof(struct aac_fibhdr);
+ if (size < le16_to_cpu(kfib->header.SenderSize))
+ size = le16_to_cpu(kfib->header.SenderSize);
+ if (size > dev->max_fib_size) {
+@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev
+ goto cleanup;
+ }
+
++ /* Sanity check the second copy */
++ if ((osize != le16_to_cpu(kfib->header.Size) +
++ sizeof(struct aac_fibhdr))
++ || (size < le16_to_cpu(kfib->header.SenderSize))) {
++ retval = -EINVAL;
++ goto cleanup;
++ }
++
+ if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
+ aac_adapter_interrupt(dev);
+ /*
--- /dev/null
+From 18b43e89d295cc65151c505c643c98fb2c320e59 Mon Sep 17 00:00:00 2001
+From: Daniel Mentz <danielmentz@google.com>
+Date: Thu, 4 Aug 2016 17:56:53 -0700
+Subject: ARC: Call trace_hardirqs_on() before enabling irqs
+
+From: Daniel Mentz <danielmentz@google.com>
+
+commit 18b43e89d295cc65151c505c643c98fb2c320e59 upstream.
+
+trace_hardirqs_on_caller() in lockdep.c expects to be called before, not
+after interrupts are actually enabled.
+
+The following comment in kernel/locking/lockdep.c substantiates this
+claim:
+
+"
+/*
+ * We're enabling irqs and according to our state above irqs weren't
+ * already enabled, yet we find the hardware thinks they are in fact
+ * enabled.. someone messed up their IRQ state tracing.
+ */
+"
+
+An example can be found in include/linux/irqflags.h:
+
+ do { trace_hardirqs_on(); raw_local_irq_enable(); } while (0)
+
+Without this change, we hit the following DEBUG_LOCKS_WARN_ON.
+
+[ 7.760000] ------------[ cut here ]------------
+[ 7.760000] WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:2711 resume_user_mode_begin+0x48/0xf0
+[ 7.770000] DEBUG_LOCKS_WARN_ON(!irqs_disabled())
+[ 7.780000] Modules linked in:
+[ 7.780000] CPU: 0 PID: 1 Comm: init Not tainted 4.7.0-00003-gc668bb9-dirty #366
+[ 7.790000]
+[ 7.790000] Stack Trace:
+[ 7.790000] arc_unwind_core.constprop.1+0xa4/0x118
+[ 7.800000] warn_slowpath_fmt+0x72/0x158
+[ 7.800000] resume_user_mode_begin+0x48/0xf0
+[ 7.810000] ---[ end trace 6f6a7a8fae20d2f0 ]---
+
+Signed-off-by: Daniel Mentz <danielmentz@google.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/include/asm/irqflags-compact.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arc/include/asm/irqflags-compact.h
++++ b/arch/arc/include/asm/irqflags-compact.h
+@@ -188,10 +188,10 @@ static inline int arch_irqs_disabled(voi
+ .endm
+
+ .macro IRQ_ENABLE scratch
++ TRACE_ASM_IRQ_ENABLE
+ lr \scratch, [status32]
+ or \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK)
+ flag \scratch
+- TRACE_ASM_IRQ_ENABLE
+ .endm
+
+ #endif /* __ASSEMBLY__ */
--- /dev/null
+From 45c3b08a117e2232fc8d7b9e849ead36386f4f96 Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Mon, 13 Jun 2016 16:38:27 +0200
+Subject: ARC: Elide redundant setup of DMA callbacks
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit 45c3b08a117e2232fc8d7b9e849ead36386f4f96 upstream.
+
+For resources shared by all cores such as SLC and IOC, only the master
+core needs to do any setups / enabling / disabling etc.
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/mm/cache.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arc/mm/cache.c
++++ b/arch/arc/mm/cache.c
+@@ -921,6 +921,15 @@ void arc_cache_init(void)
+
+ printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
+
++ /*
++ * Only master CPU needs to execute rest of function:
++ * - Assume SMP so all cores will have same cache config so
++ * any geomtry checks will be same for all
++ * - IOC setup / dma callbacks only need to be setup once
++ */
++ if (cpu)
++ return;
++
+ if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) {
+ struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache;
+
--- /dev/null
+From 1c3c909303924d30145601f47b6c058fdd2cbc2e Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Tue, 16 Aug 2016 18:27:07 -0700
+Subject: ARC: mm: fix build breakage with STRICT_MM_TYPECHECKS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit 1c3c909303924d30145601f47b6c058fdd2cbc2e upstream.
+
+| CC mm/memory.o
+| In file included from ../mm/memory.c:53:0:
+| ../include/linux/pfn_t.h: In function ‘pfn_t_pte’:
+| ../include/linux/pfn_t.h:78:2: error: conversion to non-scalar type requested
+| return pfn_pte(pfn_t_to_pfn(pfn), pgprot);
+
+With STRICT_MM_TYPECHECKS pte_t is a struct and the offending code
+forces a cast which ends up shifting a struct and hence the gcc warning.
+
+Note that in recent past some of the arches (aarch64, s390) made
+STRICT_MM_TYPECHECKS default, but we don't for ARC as this leads to slightly
+worse generated code, given ARC ABI definition of returning structs
+(which pte_t would become)
+
+Quoting from ARC ABI...
+
+ "Results of type struct are returned in a caller-supplied temporary
+ variable whose address is passed in r0.
+ For such functions, the arguments are shifted so that they are
+ passed in r1 and up."
+
+So
+ - struct to be returned would be allocated on stack requiring extra
+ code at call sites
+ - callee updates stack memory to facilitate the return (vs. simple
+ MOV into return reg r0)
+
+Hence STRICT_MM_TYPECHECKS is not enabled by default for ARC
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/include/asm/pgtable.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arc/include/asm/pgtable.h
++++ b/arch/arc/include/asm/pgtable.h
+@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp,
+
+ #define pte_page(pte) pfn_to_page(pte_pfn(pte))
+ #define mk_pte(page, prot) pfn_pte(page_to_pfn(page), prot)
+-#define pfn_pte(pfn, prot) (__pte(((pte_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
++#define pfn_pte(pfn, prot) __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
+
+ /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/
+ #define pte_pfn(pte) (pte_val(pte) >> PAGE_SHIFT)
--- /dev/null
+From 86147e3cfa5e118b61e78f4f0bf29e920dcbd477 Mon Sep 17 00:00:00 2001
+From: Liav Rehana <liavr@mellanox.com>
+Date: Tue, 16 Aug 2016 10:55:35 +0300
+Subject: ARC: use correct offset in pt_regs for saving/restoring user mode r25
+
+From: Liav Rehana <liavr@mellanox.com>
+
+commit 86147e3cfa5e118b61e78f4f0bf29e920dcbd477 upstream.
+
+User mode callee regs are explicitly collected before signal delivery or
+breakpoint trap. r25 is special for kernel as it serves as task pointer,
+so user mode value is clobbered very early. It is saved in pt_regs where
+generally only scratch (aka caller saved) regs are saved.
+
+The code to access the corresponding pt_regs location had a subtle bug as
+it was using load/store with scaling of offset, whereas the offset was already
+byte wise correct. So fix this by replacing LD.AS with a standard LD
+
+Signed-off-by: Liav Rehana <liavr@mellanox.com>
+Reviewed-by: Alexey Brodkin <abrodkin@synopsys.com>
+[vgupta: rewrote title and commit log]
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/include/asm/entry.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arc/include/asm/entry.h
++++ b/arch/arc/include/asm/entry.h
+@@ -142,7 +142,7 @@
+
+ #ifdef CONFIG_ARC_CURR_IN_REG
+ ; Retrieve orig r25 and save it with rest of callee_regs
+- ld.as r12, [r12, PT_user_r25]
++ ld r12, [r12, PT_user_r25]
+ PUSH r12
+ #else
+ PUSH r25
+@@ -198,7 +198,7 @@
+
+ ; SP is back to start of pt_regs
+ #ifdef CONFIG_ARC_CURR_IN_REG
+- st.as r12, [sp, PT_user_r25]
++ st r12, [sp, PT_user_r25]
+ #endif
+ .endm
+
--- /dev/null
+From fd363bd417ddb6103564c69cfcbd92d9a7877431 Mon Sep 17 00:00:00 2001
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Wed, 24 Aug 2016 18:02:08 +0100
+Subject: arm64: avoid TLB conflict with CONFIG_RANDOMIZE_BASE
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit fd363bd417ddb6103564c69cfcbd92d9a7877431 upstream.
+
+When CONFIG_RANDOMIZE_BASE is selected, we modify the page tables to remap the
+kernel at a newly-chosen VA range. We do this with the MMU disabled, but do not
+invalidate TLBs prior to re-enabling the MMU with the new tables. Thus the old
+mappings entries may still live in TLBs, and we risk violating
+Break-Before-Make requirements, leading to TLB conflicts and/or other issues.
+
+We invalidate TLBs when we uninsall the idmap in early setup code, but prior to
+this we are subject to issues relating to the Break-Before-Make violation.
+
+Avoid these issues by invalidating the TLBs before the new mappings can be
+used by the hardware.
+
+Fixes: f80fb3a3d508 ("arm64: add support for kernel ASLR")
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/head.S | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -757,6 +757,9 @@ ENTRY(__enable_mmu)
+ isb
+ bl __create_page_tables // recreate kernel mapping
+
++ tlbi vmalle1 // Remove any stale TLB entries
++ dsb nsh
++
+ msr sctlr_el1, x19 // re-enable the MMU
+ isb
+ ic iallu // flush instructions fetched
--- /dev/null
+From 78ec79bfd59e126e1cb394302bfa531a420b3ecd Mon Sep 17 00:00:00 2001
+From: Caesar Wang <wxt@rock-chips.com>
+Date: Wed, 27 Jul 2016 22:24:06 +0800
+Subject: arm64: dts: rockchip: add reset saradc node for rk3368 SoCs
+
+From: Caesar Wang <wxt@rock-chips.com>
+
+commit 78ec79bfd59e126e1cb394302bfa531a420b3ecd upstream.
+
+SARADC controller needs to be reset before programming it, otherwise
+it will not function properly.
+
+Signed-off-by: Caesar Wang <wxt@rock-chips.com>
+Acked-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/rockchip/rk3368.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
+@@ -270,6 +270,8 @@
+ #io-channel-cells = <1>;
+ clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
+ clock-names = "saradc", "apb_pclk";
++ resets = <&cru SRST_SARADC>;
++ reset-names = "saradc-apb";
+ status = "disabled";
+ };
+
--- /dev/null
+From bc9f3d7788a88d080a30599bde68f383daf8f8a5 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Wed, 17 Aug 2016 17:54:41 +0200
+Subject: arm64: kernel: avoid literal load of virtual address with MMU off
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit bc9f3d7788a88d080a30599bde68f383daf8f8a5 upstream.
+
+Literal loads of virtual addresses are subject to runtime relocation when
+CONFIG_RELOCATABLE=y, and given that the relocation routines run with the
+MMU and caches enabled, literal loads of relocated values performed with
+the MMU off are not guaranteed to return the latest value unless the
+memory covering the literal is cleaned to the PoC explicitly.
+
+So defer the literal load until after the MMU has been enabled, just like
+we do for primary_switch() and secondary_switch() in head.S.
+
+Fixes: 1e48ef7fcc37 ("arm64: add support for building vmlinux as a relocatable PIE binary")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/sleep.S | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/sleep.S
++++ b/arch/arm64/kernel/sleep.S
+@@ -101,12 +101,20 @@ ENTRY(cpu_resume)
+ bl el2_setup // if in EL2 drop to EL1 cleanly
+ /* enable the MMU early - so we can access sleep_save_stash by va */
+ adr_l lr, __enable_mmu /* __cpu_setup will return here */
+- ldr x27, =_cpu_resume /* __enable_mmu will branch here */
++ adr_l x27, _resume_switched /* __enable_mmu will branch here */
+ adrp x25, idmap_pg_dir
+ adrp x26, swapper_pg_dir
+ b __cpu_setup
+ ENDPROC(cpu_resume)
+
++ .pushsection ".idmap.text", "ax"
++_resume_switched:
++ ldr x8, =_cpu_resume
++ br x8
++ENDPROC(_resume_switched)
++ .ltorg
++ .popsection
++
+ ENTRY(_cpu_resume)
+ mrs x1, mpidr_el1
+ adrp x8, mpidr_hash
--- /dev/null
+From 744c6c37cc18705d19e179622f927f5b781fe9cc Mon Sep 17 00:00:00 2001
+From: James Morse <james.morse@arm.com>
+Date: Fri, 26 Aug 2016 16:03:42 +0100
+Subject: arm64: kernel: Fix unmasked debug exceptions when restoring mdscr_el1
+
+From: James Morse <james.morse@arm.com>
+
+commit 744c6c37cc18705d19e179622f927f5b781fe9cc upstream.
+
+Changes to make the resume from cpu_suspend() code behave more like
+secondary boot caused debug exceptions to be unmasked early by
+__cpu_setup(). We then go on to restore mdscr_el1 in cpu_do_resume(),
+potentially taking break or watch points based on uninitialised registers.
+
+Mask debug exceptions in cpu_do_resume(), which is specific to resume
+from cpu_suspend(). Debug exceptions will be restored to their original
+state by local_dbg_restore() in cpu_suspend(), which runs after
+hw_breakpoint_restore() has re-initialised the other registers.
+
+Reported-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Fixes: cabe1c81ea5b ("arm64: Change cpu_resume() to enable mmu early then access sleep_sp by va")
+Signed-off-by: James Morse <james.morse@arm.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/mm/proc.S | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/arm64/mm/proc.S
++++ b/arch/arm64/mm/proc.S
+@@ -100,7 +100,16 @@ ENTRY(cpu_do_resume)
+
+ msr tcr_el1, x8
+ msr vbar_el1, x9
++
++ /*
++ * __cpu_setup() cleared MDSCR_EL1.MDE and friends, before unmasking
++ * debug exceptions. By restoring MDSCR_EL1 here, we may take a debug
++ * exception. Mask them until local_dbg_restore() in cpu_suspend()
++ * resets them.
++ */
++ disable_dbg
+ msr mdscr_el1, x10
++
+ msr sctlr_el1, x12
+ /*
+ * Restore oslsr_el1 by writing oslar_el1
--- /dev/null
+From 35bbb97fc898aeb874cb7c8b746f091caa359994 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Wed, 17 Aug 2016 21:58:33 -0400
+Subject: btrfs: don't create or leak aliased root while cleaning up orphans
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit 35bbb97fc898aeb874cb7c8b746f091caa359994 upstream.
+
+commit 909c3a22da3 (Btrfs: fix loading of orphan roots leading to BUG_ON)
+avoids the BUG_ON but can add an aliased root to the dead_roots list or
+leak the root.
+
+Since we've already been loading roots into the radix tree, we should
+use it before looking the root up on disk.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/disk-io.c | 4 ++--
+ fs/btrfs/disk-io.h | 2 ++
+ fs/btrfs/root-tree.c | 27 ++++++++++++++++++---------
+ 3 files changed, 22 insertions(+), 11 deletions(-)
+
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1626,8 +1626,8 @@ fail:
+ return ret;
+ }
+
+-static struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
+- u64 root_id)
++struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
++ u64 root_id)
+ {
+ struct btrfs_root *root;
+
+--- a/fs/btrfs/disk-io.h
++++ b/fs/btrfs/disk-io.h
+@@ -68,6 +68,8 @@ struct extent_buffer *btrfs_find_tree_bl
+ struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root,
+ struct btrfs_key *location);
+ int btrfs_init_fs_root(struct btrfs_root *root);
++struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
++ u64 root_id);
+ int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info,
+ struct btrfs_root *root);
+ void btrfs_free_fs_roots(struct btrfs_fs_info *fs_info);
+--- a/fs/btrfs/root-tree.c
++++ b/fs/btrfs/root-tree.c
+@@ -272,6 +272,23 @@ int btrfs_find_orphan_roots(struct btrfs
+ root_key.objectid = key.offset;
+ key.offset++;
+
++ /*
++ * The root might have been inserted already, as before we look
++ * for orphan roots, log replay might have happened, which
++ * triggers a transaction commit and qgroup accounting, which
++ * in turn reads and inserts fs roots while doing backref
++ * walking.
++ */
++ root = btrfs_lookup_fs_root(tree_root->fs_info,
++ root_key.objectid);
++ if (root) {
++ WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED,
++ &root->state));
++ if (btrfs_root_refs(&root->root_item) == 0)
++ btrfs_add_dead_root(root);
++ continue;
++ }
++
+ root = btrfs_read_fs_root(tree_root, &root_key);
+ err = PTR_ERR_OR_ZERO(root);
+ if (err && err != -ENOENT) {
+@@ -310,16 +327,8 @@ int btrfs_find_orphan_roots(struct btrfs
+ set_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state);
+
+ err = btrfs_insert_fs_root(root->fs_info, root);
+- /*
+- * The root might have been inserted already, as before we look
+- * for orphan roots, log replay might have happened, which
+- * triggers a transaction commit and qgroup accounting, which
+- * in turn reads and inserts fs roots while doing backref
+- * walking.
+- */
+- if (err == -EEXIST)
+- err = 0;
+ if (err) {
++ BUG_ON(err == -EEXIST);
+ btrfs_free_fs_root(root);
+ break;
+ }
--- /dev/null
+From d2c609b834d62f1e91f1635a27dca29f7806d3d6 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Mon, 15 Aug 2016 12:10:33 -0400
+Subject: btrfs: properly track when rescan worker is running
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit d2c609b834d62f1e91f1635a27dca29f7806d3d6 upstream.
+
+The qgroup_flags field is overloaded such that it reflects the on-disk
+status of qgroups and the runtime state. The BTRFS_QGROUP_STATUS_FLAG_RESCAN
+flag is used to indicate that a rescan operation is in progress, but if
+the file system is unmounted while a rescan is running, the rescan
+operation is paused. If the file system is then mounted read-only,
+the flag will still be present but the rescan operation will not have
+been resumed. When we go to umount, btrfs_qgroup_wait_for_completion
+will see the flag and interpret it to mean that the rescan worker is
+still running and will wait for a completion that will never come.
+
+This patch uses a separate flag to indicate when the worker is
+running. The locking and state surrounding the qgroup rescan worker
+needs a lot of attention beyond this patch but this is enough to
+avoid a hung umount.
+
+Signed-off-by; Jeff Mahoney <jeffm@suse.com>
+Reviewed-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Signed-off-by: Chris Mason <clm@fb.com>
+
+---
+ fs/btrfs/ctree.h | 1 +
+ fs/btrfs/disk-io.c | 1 +
+ fs/btrfs/qgroup.c | 9 ++++++++-
+ 3 files changed, 10 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1040,6 +1040,7 @@ struct btrfs_fs_info {
+ struct btrfs_workqueue *qgroup_rescan_workers;
+ struct completion qgroup_rescan_completion;
+ struct btrfs_work qgroup_rescan_work;
++ bool qgroup_rescan_running; /* protected by qgroup_rescan_lock */
+
+ /* filesystem state */
+ unsigned long fs_state;
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -2306,6 +2306,7 @@ static void btrfs_init_qgroup(struct btr
+ fs_info->quota_enabled = 0;
+ fs_info->pending_quota_state = 0;
+ fs_info->qgroup_ulist = NULL;
++ fs_info->qgroup_rescan_running = false;
+ mutex_init(&fs_info->qgroup_rescan_lock);
+ }
+
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -2302,6 +2302,10 @@ static void btrfs_qgroup_rescan_worker(s
+ int err = -ENOMEM;
+ int ret = 0;
+
++ mutex_lock(&fs_info->qgroup_rescan_lock);
++ fs_info->qgroup_rescan_running = true;
++ mutex_unlock(&fs_info->qgroup_rescan_lock);
++
+ path = btrfs_alloc_path();
+ if (!path)
+ goto out;
+@@ -2368,6 +2372,9 @@ out:
+ }
+
+ done:
++ mutex_lock(&fs_info->qgroup_rescan_lock);
++ fs_info->qgroup_rescan_running = false;
++ mutex_unlock(&fs_info->qgroup_rescan_lock);
+ complete_all(&fs_info->qgroup_rescan_completion);
+ }
+
+@@ -2494,7 +2501,7 @@ int btrfs_qgroup_wait_for_completion(str
+
+ mutex_lock(&fs_info->qgroup_rescan_lock);
+ spin_lock(&fs_info->qgroup_lock);
+- running = fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN;
++ running = fs_info->qgroup_rescan_running;
+ spin_unlock(&fs_info->qgroup_lock);
+ mutex_unlock(&fs_info->qgroup_rescan_lock);
+
--- /dev/null
+From d06f23d6a947c9abae41dc46be69a56baf36f436 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Mon, 8 Aug 2016 22:08:06 -0400
+Subject: btrfs: waiting on qgroup rescan should not always be interruptible
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit d06f23d6a947c9abae41dc46be69a56baf36f436 upstream.
+
+We wait on qgroup rescan completion in three places: file system
+shutdown, the quota disable ioctl, and the rescan wait ioctl. If the
+user sends a signal while we're waiting, we continue happily along. This
+is expected behavior for the rescan wait ioctl. It's racy in the shutdown
+path but mostly works due to other unrelated synchronization points.
+In the quota disable path, it Oopses the kernel pretty much immediately.
+
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/disk-io.c | 2 +-
+ fs/btrfs/ioctl.c | 2 +-
+ fs/btrfs/qgroup.c | 12 +++++++++---
+ fs/btrfs/qgroup.h | 3 ++-
+ 4 files changed, 13 insertions(+), 6 deletions(-)
+
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3849,7 +3849,7 @@ void close_ctree(struct btrfs_root *root
+ smp_mb();
+
+ /* wait for the qgroup rescan worker to stop */
+- btrfs_qgroup_wait_for_completion(fs_info);
++ btrfs_qgroup_wait_for_completion(fs_info, false);
+
+ /* wait for the uuid_scan task to finish */
+ down(&fs_info->uuid_tree_rescan_sem);
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -5088,7 +5088,7 @@ static long btrfs_ioctl_quota_rescan_wai
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+- return btrfs_qgroup_wait_for_completion(root->fs_info);
++ return btrfs_qgroup_wait_for_completion(root->fs_info, true);
+ }
+
+ static long _btrfs_ioctl_set_received_subvol(struct file *file,
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -995,7 +995,7 @@ int btrfs_quota_disable(struct btrfs_tra
+ goto out;
+ fs_info->quota_enabled = 0;
+ fs_info->pending_quota_state = 0;
+- btrfs_qgroup_wait_for_completion(fs_info);
++ btrfs_qgroup_wait_for_completion(fs_info, false);
+ spin_lock(&fs_info->qgroup_lock);
+ quota_root = fs_info->quota_root;
+ fs_info->quota_root = NULL;
+@@ -2486,7 +2486,8 @@ btrfs_qgroup_rescan(struct btrfs_fs_info
+ return 0;
+ }
+
+-int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info)
++int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
++ bool interruptible)
+ {
+ int running;
+ int ret = 0;
+@@ -2497,9 +2498,14 @@ int btrfs_qgroup_wait_for_completion(str
+ spin_unlock(&fs_info->qgroup_lock);
+ mutex_unlock(&fs_info->qgroup_rescan_lock);
+
+- if (running)
++ if (!running)
++ return 0;
++
++ if (interruptible)
+ ret = wait_for_completion_interruptible(
+ &fs_info->qgroup_rescan_completion);
++ else
++ wait_for_completion(&fs_info->qgroup_rescan_completion);
+
+ return ret;
+ }
+--- a/fs/btrfs/qgroup.h
++++ b/fs/btrfs/qgroup.h
+@@ -46,7 +46,8 @@ int btrfs_quota_disable(struct btrfs_tra
+ struct btrfs_fs_info *fs_info);
+ int btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info);
+ void btrfs_qgroup_rescan_resume(struct btrfs_fs_info *fs_info);
+-int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info);
++int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
++ bool interruptible);
+ int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info, u64 src, u64 dst);
+ int btrfs_del_qgroup_relation(struct btrfs_trans_handle *trans,
--- /dev/null
+From add125054b8727103631dce116361668436ef6a7 Mon Sep 17 00:00:00 2001
+From: Gavin Li <git@thegavinli.com>
+Date: Fri, 12 Aug 2016 00:52:56 -0700
+Subject: cdc-acm: fix wrong pipe type on rx interrupt xfers
+
+From: Gavin Li <git@thegavinli.com>
+
+commit add125054b8727103631dce116361668436ef6a7 upstream.
+
+This fixes the "BOGUS urb xfer" warning logged by usb_submit_urb().
+
+Signed-off-by: Gavin Li <git@thegavinli.com>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 5 ++---
+ drivers/usb/class/cdc-acm.h | 1 -
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1405,7 +1405,6 @@ made_compressed_probe:
+ spin_lock_init(&acm->write_lock);
+ spin_lock_init(&acm->read_lock);
+ mutex_init(&acm->mutex);
+- acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
+ acm->is_int_ep = usb_endpoint_xfer_int(epread);
+ if (acm->is_int_ep)
+ acm->bInterval = epread->bInterval;
+@@ -1445,14 +1444,14 @@ made_compressed_probe:
+ urb->transfer_dma = rb->dma;
+ if (acm->is_int_ep) {
+ usb_fill_int_urb(urb, acm->dev,
+- acm->rx_endpoint,
++ usb_rcvintpipe(usb_dev, epread->bEndpointAddress),
+ rb->base,
+ acm->readsize,
+ acm_read_bulk_callback, rb,
+ acm->bInterval);
+ } else {
+ usb_fill_bulk_urb(urb, acm->dev,
+- acm->rx_endpoint,
++ usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress),
+ rb->base,
+ acm->readsize,
+ acm_read_bulk_callback, rb);
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -96,7 +96,6 @@ struct acm {
+ struct acm_rb read_buffers[ACM_NR];
+ struct acm_wb *putbuffer; /* for acm_tty_put_char() */
+ int rx_buflimit;
+- int rx_endpoint;
+ spinlock_t read_lock;
+ int write_used; /* number of non-empty write buffers */
+ int transmitting;
--- /dev/null
+From d0e5845561c238619de9f5b77e0d763f4c331ca5 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 25 Aug 2016 15:17:14 -0700
+Subject: dax: fix device-dax region base
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit d0e5845561c238619de9f5b77e0d763f4c331ca5 upstream.
+
+The data offset for a dax region needs to account for a reservation in
+the resource range. Otherwise, device-dax is allowing mappings directly
+into the memmap or device-info-block area with crash signatures like the
+following:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
+ IP: get_zone_device_page+0x11/0x30
+ Call Trace:
+ follow_devmap_pmd+0x298/0x2c0
+ follow_page_mask+0x275/0x530
+ __get_user_pages+0xe3/0x750
+ __gfn_to_pfn_memslot+0x1b2/0x450 [kvm]
+ tdp_page_fault+0x130/0x280 [kvm]
+ kvm_mmu_page_fault+0x5f/0xf0 [kvm]
+ handle_ept_violation+0x94/0x180 [kvm_intel]
+ vmx_handle_exit+0x1d3/0x1440 [kvm_intel]
+ kvm_arch_vcpu_ioctl_run+0x81d/0x16a0 [kvm]
+ kvm_vcpu_ioctl+0x33c/0x620 [kvm]
+ do_vfs_ioctl+0xa2/0x5d0
+ SyS_ioctl+0x79/0x90
+ entry_SYSCALL_64_fastpath+0x1a/0xa4
+
+Fixes: ab68f2622136 ("/dev/dax, pmem: direct access to persistent memory")
+Link: http://lkml.kernel.org/r/147205536732.1606.8994275381938837346.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Reported-by: Abhilash Kumar Mulumudi <m.abhilash-kumar@hpe.com>
+Reported-by: Toshi Kani <toshi.kani@hpe.com>
+Tested-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dax/pmem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/dax/pmem.c
++++ b/drivers/dax/pmem.c
+@@ -118,6 +118,9 @@ static int dax_pmem_probe(struct device
+ return rc;
+ }
+
++ /* adjust the dax_region resource to the start of data */
++ res.start += le64_to_cpu(pfn_sb->dataoff);
++
+ nd_region = to_nd_region(dev->parent);
+ dax_region = alloc_dax_region(dev, nd_region->id, &res,
+ le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP);
--- /dev/null
+From 802934b2cfde463b72cc1b9bc1c081895a90be53 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Fri, 5 Aug 2016 12:29:06 -0400
+Subject: dm round robin: do not use this_cpu_ptr() without having preemption disabled
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 802934b2cfde463b72cc1b9bc1c081895a90be53 upstream.
+
+Use local_irq_save() to disable preemption before calling
+this_cpu_ptr().
+
+Reported-by: Benjamin Block <bblock@linux.vnet.ibm.com>
+Fixes: b0b477c7e0dd ("dm round robin: use percpu 'repeat_count' and 'current_path'")
+Suggested-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-round-robin.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-round-robin.c
++++ b/drivers/md/dm-round-robin.c
+@@ -210,14 +210,17 @@ static struct dm_path *rr_select_path(st
+ struct path_info *pi = NULL;
+ struct dm_path *current_path = NULL;
+
++ local_irq_save(flags);
+ current_path = *this_cpu_ptr(s->current_path);
+ if (current_path) {
+ percpu_counter_dec(&s->repeat_count);
+- if (percpu_counter_read_positive(&s->repeat_count) > 0)
++ if (percpu_counter_read_positive(&s->repeat_count) > 0) {
++ local_irq_restore(flags);
+ return current_path;
++ }
+ }
+
+- spin_lock_irqsave(&s->lock, flags);
++ spin_lock(&s->lock);
+ if (!list_empty(&s->valid_paths)) {
+ pi = list_entry(s->valid_paths.next, struct path_info, list);
+ list_move_tail(&pi->list, &s->valid_paths);
--- /dev/null
+From 53960b4f89db58bc155d6f8aa0a44ccc59ccb26f Mon Sep 17 00:00:00 2001
+From: jimqu <Jim.Qu@amd.com>
+Date: Tue, 30 Aug 2016 09:03:16 +0800
+Subject: drm/amd/amdgpu: compute ring test fail during S4 on CI
+
+From: jimqu <Jim.Qu@amd.com>
+
+commit 53960b4f89db58bc155d6f8aa0a44ccc59ccb26f upstream.
+
+unhalt Instrction Fetch Unit after all rings are inited.
+
+Signed-off-by: JimQu <Jim.Qu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+@@ -2777,8 +2777,7 @@ static int gfx_v7_0_cp_compute_resume(st
+ u64 wb_gpu_addr;
+ u32 *buf;
+ struct bonaire_mqd *mqd;
+-
+- gfx_v7_0_cp_compute_enable(adev, true);
++ struct amdgpu_ring *ring;
+
+ /* fix up chicken bits */
+ tmp = RREG32(mmCP_CPF_DEBUG);
+@@ -2813,7 +2812,7 @@ static int gfx_v7_0_cp_compute_resume(st
+
+ /* init the queues. Just two for now. */
+ for (i = 0; i < adev->gfx.num_compute_rings; i++) {
+- struct amdgpu_ring *ring = &adev->gfx.compute_ring[i];
++ ring = &adev->gfx.compute_ring[i];
+
+ if (ring->mqd_obj == NULL) {
+ r = amdgpu_bo_create(adev,
+@@ -2992,6 +2991,13 @@ static int gfx_v7_0_cp_compute_resume(st
+ amdgpu_bo_unreserve(ring->mqd_obj);
+
+ ring->ready = true;
++ }
++
++ gfx_v7_0_cp_compute_enable(adev, true);
++
++ for (i = 0; i < adev->gfx.num_compute_rings; i++) {
++ ring = &adev->gfx.compute_ring[i];
++
+ r = amdgpu_ring_test_ring(ring);
+ if (r)
+ ring->ready = false;
--- /dev/null
+From 10ea9434065e56fe14287f89258ecf2fb684ed1a Mon Sep 17 00:00:00 2001
+From: jimqu <Jim.Qu@amd.com>
+Date: Tue, 30 Aug 2016 08:59:42 +0800
+Subject: drm/amd/amdgpu: sdma resume fail during S4 on CI
+
+From: jimqu <Jim.Qu@amd.com>
+
+commit 10ea9434065e56fe14287f89258ecf2fb684ed1a upstream.
+
+SDMA could be fail in the thaw() and restore() processes, do software reset
+if each SDMA engine is busy.
+
+Signed-off-by: JimQu <Jim.Qu@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
++++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+@@ -52,6 +52,7 @@ static void cik_sdma_set_ring_funcs(stru
+ static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev);
+ static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev);
+ static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev);
++static int cik_sdma_soft_reset(void *handle);
+
+ MODULE_FIRMWARE("radeon/bonaire_sdma.bin");
+ MODULE_FIRMWARE("radeon/bonaire_sdma1.bin");
+@@ -1051,6 +1052,8 @@ static int cik_sdma_resume(void *handle)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
++ cik_sdma_soft_reset(handle);
++
+ return cik_sdma_hw_init(adev);
+ }
+
--- /dev/null
+From e1718d97aa88ea44a6a8f50ff464253dd0dacf01 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 24 Aug 2016 12:31:36 -0400
+Subject: drm/amdgpu: avoid a possible array overflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e1718d97aa88ea44a6a8f50ff464253dd0dacf01 upstream.
+
+When looking up the connector type make sure the index
+is valid. Avoids a later crash if we read past the end
+of the array.
+
+Workaround for bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=97460
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -321,6 +321,12 @@ bool amdgpu_atombios_get_connector_info_
+ (le16_to_cpu(path->usConnObjectId) &
+ OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+
++ if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) {
++ DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n",
++ con_obj_id, le16_to_cpu(path->usDeviceTag));
++ continue;
++ }
++
+ connector_type =
+ object_connector_convert[con_obj_id];
+ connector_object_id = con_obj_id;
--- /dev/null
+From cab0b8d50e9bbef62c04067072c953433a87a9ff Mon Sep 17 00:00:00 2001
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+Date: Fri, 12 Aug 2016 19:25:21 -0400
+Subject: drm/amdgpu: Change GART offset to 64-bit
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+commit cab0b8d50e9bbef62c04067072c953433a87a9ff upstream.
+
+The GART aperture size can be bigger than 4GB. Therefore the offset
+used in amdgpu_gart_bind and amdgpu_gart_unbind must be 64-bit.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu.h | 4 ++--
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -637,9 +637,9 @@ int amdgpu_gart_table_vram_pin(struct am
+ void amdgpu_gart_table_vram_unpin(struct amdgpu_device *adev);
+ int amdgpu_gart_init(struct amdgpu_device *adev);
+ void amdgpu_gart_fini(struct amdgpu_device *adev);
+-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
++void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
+ int pages);
+-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
++int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
+ int pages, struct page **pagelist,
+ dma_addr_t *dma_addr, uint32_t flags);
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+@@ -221,7 +221,7 @@ void amdgpu_gart_table_vram_free(struct
+ * Unbinds the requested pages from the gart page table and
+ * replaces them with the dummy page (all asics).
+ */
+-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
++void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
+ int pages)
+ {
+ unsigned t;
+@@ -268,7 +268,7 @@ void amdgpu_gart_unbind(struct amdgpu_de
+ * (all asics).
+ * Returns 0 for success, -EINVAL for failure.
+ */
+-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
++int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
+ int pages, struct page **pagelist, dma_addr_t *dma_addr,
+ uint32_t flags)
+ {
--- /dev/null
+From 815d27a46f3119f74fe01fe10bf683aa5bc55597 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Wed, 17 Aug 2016 09:45:25 +0200
+Subject: drm/amdgpu: fix amdgpu_move_blit on 32bit systems
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 815d27a46f3119f74fe01fe10bf683aa5bc55597 upstream.
+
+This bug seems to be present for a very long time.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -251,8 +251,8 @@ static int amdgpu_move_blit(struct ttm_b
+
+ adev = amdgpu_get_adev(bo->bdev);
+ ring = adev->mman.buffer_funcs_ring;
+- old_start = old_mem->start << PAGE_SHIFT;
+- new_start = new_mem->start << PAGE_SHIFT;
++ old_start = (u64)old_mem->start << PAGE_SHIFT;
++ new_start = (u64)new_mem->start << PAGE_SHIFT;
+
+ switch (old_mem->mem_type) {
+ case TTM_PL_VRAM:
--- /dev/null
+From 5661538749511d4c2f7d33e1e179f10c545b24d5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Wed, 17 Aug 2016 13:44:20 +0200
+Subject: drm/amdgpu: fix lru size grouping v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 5661538749511d4c2f7d33e1e179f10c545b24d5 upstream.
+
+Adding a BO can make it the insertion point for larger sizes as well.
+
+v2: add a comment about the guard structure.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu.h | 2 ++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 8 ++++++++
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+@@ -415,6 +415,8 @@ struct amdgpu_mman {
+
+ /* custom LRU management */
+ struct amdgpu_mman_lru log2_size[AMDGPU_TTM_LRU_SIZE];
++ /* guard for log2_size array, don't add anything in between */
++ struct amdgpu_mman_lru guard;
+ };
+
+ int amdgpu_copy_buffer(struct amdgpu_ring *ring,
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -943,6 +943,8 @@ static struct list_head *amdgpu_ttm_lru_
+ struct list_head *res = lru->lru[tbo->mem.mem_type];
+
+ lru->lru[tbo->mem.mem_type] = &tbo->lru;
++ while ((++lru)->lru[tbo->mem.mem_type] == res)
++ lru->lru[tbo->mem.mem_type] = &tbo->lru;
+
+ return res;
+ }
+@@ -953,6 +955,8 @@ static struct list_head *amdgpu_ttm_swap
+ struct list_head *res = lru->swap_lru;
+
+ lru->swap_lru = &tbo->swap;
++ while ((++lru)->swap_lru == res)
++ lru->swap_lru = &tbo->swap;
+
+ return res;
+ }
+@@ -1004,6 +1008,10 @@ int amdgpu_ttm_init(struct amdgpu_device
+ lru->swap_lru = &adev->mman.bdev.glob->swap_lru;
+ }
+
++ for (j = 0; j < TTM_NUM_MEM_TYPES; ++j)
++ adev->mman.guard.lru[j] = NULL;
++ adev->mman.guard.swap_lru = NULL;
++
+ adev->mman.initialized = true;
+ r = ttm_bo_init_mm(&adev->mman.bdev, TTM_PL_VRAM,
+ adev->mc.real_vram_size >> PAGE_SHIFT);
--- /dev/null
+From 1f703e6679f373f5bba4efe7093aa82e91af4037 Mon Sep 17 00:00:00 2001
+From: Chunming Zhou <David1.Zhou@amd.com>
+Date: Tue, 30 Aug 2016 17:59:11 +0800
+Subject: drm/amdgpu: record error code when ring test failed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chunming Zhou <David1.Zhou@amd.com>
+
+commit 1f703e6679f373f5bba4efe7093aa82e91af4037 upstream.
+
+Otherwise we may miss errors.
+
+Signed-off-by: Chunming Zhou <David1.Zhou@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+@@ -288,7 +288,7 @@ void amdgpu_ib_pool_fini(struct amdgpu_d
+ int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
+ {
+ unsigned i;
+- int r;
++ int r, ret = 0;
+
+ for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
+ struct amdgpu_ring *ring = adev->rings[i];
+@@ -309,10 +309,11 @@ int amdgpu_ib_ring_tests(struct amdgpu_d
+ } else {
+ /* still not good, but we can live with it */
+ DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r);
++ ret = r;
+ }
+ }
+ }
+- return 0;
++ return ret;
+ }
+
+ /*
--- /dev/null
+From 611a1507fe8569ce1adab3abc982ea58ab559fb9 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 24 Aug 2016 13:04:15 -0400
+Subject: drm/amdgpu: skip TV/CV in display parsing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 611a1507fe8569ce1adab3abc982ea58ab559fb9 upstream.
+
+No asics supported by amdgpu support analog TV.
+
+Workaround for bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=97460
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -321,6 +321,13 @@ bool amdgpu_atombios_get_connector_info_
+ (le16_to_cpu(path->usConnObjectId) &
+ OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+
++ /* Skip TV/CV support */
++ if ((le16_to_cpu(path->usDeviceTag) ==
++ ATOM_DEVICE_TV1_SUPPORT) ||
++ (le16_to_cpu(path->usDeviceTag) ==
++ ATOM_DEVICE_CV_SUPPORT))
++ continue;
++
+ if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) {
+ DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n",
+ con_obj_id, le16_to_cpu(path->usDeviceTag));
--- /dev/null
+From 3cffb0a44750726cdc1cc07399efe3cbb45e028b Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 3 Aug 2016 17:09:00 +0100
+Subject: drm/i915: Acquire audio powerwell for HD-Audio registers
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 3cffb0a44750726cdc1cc07399efe3cbb45e028b upstream.
+
+On Haswell/Broadwell, the HD-Audio block is inside the HDMI/display
+power well and so the sna-hda audio codec acquires the display power
+well while it is operational. However, Skylake separates the powerwells
+again, but yet we still need the audio powerwell to setup the registers.
+(But then the hardware uses those registers even while powered off???)
+
+Acquiring the powerwell around setting the chicken bits when setting up
+the audio channel does at least silence the WARNs from touching our
+registers whilst unpowered. We silence our own test cases, but maybe
+there is a latent bug in using the audio channel?
+
+v2: Grab both rpm wakelock and audio wakelock
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96214
+Fixes: 03b135cebc47 "ALSA: hda - remove dependency on i915 power well for SKL")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Libin Yang <libin.yang@intel.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Marius Vlad <marius.c.vlad@intel.com>
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1470240540-29004-1-git-send-email-chris@chris-wilson.co.uk
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+(cherry picked from commit d838a110f0b310d408ebe6b5a97e36ec27555ebf)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_audio.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_audio.c
++++ b/drivers/gpu/drm/i915/intel_audio.c
+@@ -600,6 +600,8 @@ static void i915_audio_component_codec_w
+ if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv))
+ return;
+
++ i915_audio_component_get_power(dev);
++
+ /*
+ * Enable/disable generating the codec wake signal, overriding the
+ * internal logic to generate the codec wake to controller.
+@@ -615,6 +617,8 @@ static void i915_audio_component_codec_w
+ I915_WRITE(HSW_AUD_CHICKENBIT, tmp);
+ usleep_range(1000, 1500);
+ }
++
++ i915_audio_component_put_power(dev);
+ }
+
+ /* Get CDCLK in kHz */
+@@ -654,6 +658,7 @@ static int i915_audio_component_sync_aud
+ !IS_HASWELL(dev_priv))
+ return 0;
+
++ i915_audio_component_get_power(dev);
+ mutex_lock(&dev_priv->av_mutex);
+ /* 1. get the pipe */
+ intel_encoder = dev_priv->dig_port_map[port];
+@@ -704,6 +709,7 @@ static int i915_audio_component_sync_aud
+
+ unlock:
+ mutex_unlock(&dev_priv->av_mutex);
++ i915_audio_component_put_power(dev);
+ return err;
+ }
+
--- /dev/null
+From 84c8e0963da434d37355079b568465cd121af295 Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Tue, 21 Jun 2016 17:03:44 -0400
+Subject: drm/i915: Enable polling when we don't have hpd
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude <cpaul@redhat.com>
+
+commit 84c8e0963da434d37355079b568465cd121af295 upstream.
+
+Unfortunately, there's two situations where we lose hpd right now:
+- Runtime suspend
+- When we've shut off all of the power wells on Valleyview/Cherryview
+
+While it would be nice if this didn't cause issues, this has the
+ability to get us in some awkward states where a user won't be able to
+get their display to turn on. For instance; if we boot a Valleyview
+system without any monitors connected, it won't need any of it's power
+wells and thus shut them off. Since this causes us to lose HPD, this
+means that unless the user knows how to ssh into their machine and do a
+manual reprobe for monitors, none of the monitors they connect after
+booting will actually work.
+
+Eventually we should come up with a better fix then having to enable
+polling for this, since this makes rpm a lot less useful, but for now
+the infrastructure in i915 just isn't there yet to get hpd in these
+situations.
+
+Changes since v1:
+ - Add comment explaining the addition of the if
+ (!mode_config->poll_running) in intel_hpd_init()
+ - Remove unneeded if (!dev->mode_config.poll_enabled) in
+ i915_hpd_poll_init_work()
+ - Call to drm_helper_hpd_irq_event() after we disable polling
+ - Add cancel_work_sync() call to intel_hpd_cancel_work()
+
+Changes since v2:
+ - Apparently dev->mode_config.poll_running doesn't actually reflect
+ whether or not a poll is currently in progress, and is actually used
+ for dynamic module paramter enabling/disabling. So now we instead
+ keep track of our own poll_running variable in dev_priv->hotplug
+ - Clean i915_hpd_poll_init_work() a little bit
+
+Changes since v3:
+ - Remove the now-redundant connector loop in intel_hpd_init(), just
+ rely on intel_hpd_poll_enable() for setting connector->polled
+ correctly on each connector
+ - Get rid of poll_running
+ - Don't assign enabled in i915_hpd_poll_init_work before we actually
+ lock dev->mode_config.mutex
+ - Wrap enabled assignment in i915_hpd_poll_init_work() in READ_ONCE()
+ for doc purposes
+ - Do the same for dev_priv->hotplug.poll_enabled with WRITE_ONCE in
+ intel_hpd_poll_enable()
+ - Add some comments about racing not mattering in intel_hpd_poll_enable
+
+Changes since v4:
+ - Rename intel_hpd_poll_enable() to intel_hpd_poll_init()
+ - Drop the bool argument from intel_hpd_poll_init()
+ - Remove redundant calls to intel_hpd_poll_init()
+ - Rename poll_enable_work to poll_init_work
+ - Add some kerneldoc for intel_hpd_poll_init()
+ - Cross-reference intel_hpd_poll_init() in intel_hpd_init()
+ - Just copy the loop from intel_hpd_init() in intel_hpd_poll_init()
+
+Changes since v5:
+ - Minor kerneldoc nitpicks
+
+Cc: stable@vger.kernel.org
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Lyude <cpaul@redhat.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+(cherry picked from commit 19625e85c6ec56038368aa72c44f5f55b221f0fc)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_drv.c | 3 +
+ drivers/gpu/drm/i915/i915_drv.h | 3 +
+ drivers/gpu/drm/i915/intel_drv.h | 2
+ drivers/gpu/drm/i915/intel_hotplug.c | 90 +++++++++++++++++++++++++++-----
+ drivers/gpu/drm/i915/intel_runtime_pm.c | 2
+ 5 files changed, 88 insertions(+), 12 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_drv.c
++++ b/drivers/gpu/drm/i915/i915_drv.c
+@@ -1578,6 +1578,9 @@ static int intel_runtime_suspend(struct
+
+ assert_forcewakes_inactive(dev_priv);
+
++ if (!IS_VALLEYVIEW(dev_priv) || !IS_CHERRYVIEW(dev_priv))
++ intel_hpd_poll_init(dev_priv);
++
+ DRM_DEBUG_KMS("Device suspended\n");
+ return 0;
+ }
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -281,6 +281,9 @@ struct i915_hotplug {
+ u32 short_port_mask;
+ struct work_struct dig_port_work;
+
++ struct work_struct poll_init_work;
++ bool poll_enabled;
++
+ /*
+ * if we get a HPD irq from DP and a HPD irq from non-DP
+ * the non-DP HPD could block the workqueue on a mode config
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -1346,6 +1346,8 @@ void intel_dsi_init(struct drm_device *d
+
+ /* intel_dvo.c */
+ void intel_dvo_init(struct drm_device *dev);
++/* intel_hotplug.c */
++void intel_hpd_poll_init(struct drm_i915_private *dev_priv);
+
+
+ /* legacy fbdev emulation in intel_fbdev.c */
+--- a/drivers/gpu/drm/i915/intel_hotplug.c
++++ b/drivers/gpu/drm/i915/intel_hotplug.c
+@@ -453,20 +453,47 @@ void intel_hpd_irq_handler(struct drm_de
+ *
+ * This is a separate step from interrupt enabling to simplify the locking rules
+ * in the driver load and resume code.
++ *
++ * Also see: intel_hpd_poll_init(), which enables connector polling
+ */
+ void intel_hpd_init(struct drm_i915_private *dev_priv)
+ {
+- struct drm_device *dev = dev_priv->dev;
+- struct drm_mode_config *mode_config = &dev->mode_config;
+- struct drm_connector *connector;
+ int i;
+
+ for_each_hpd_pin(i) {
+ dev_priv->hotplug.stats[i].count = 0;
+ dev_priv->hotplug.stats[i].state = HPD_ENABLED;
+ }
++
++ WRITE_ONCE(dev_priv->hotplug.poll_enabled, false);
++ schedule_work(&dev_priv->hotplug.poll_init_work);
++
++ /*
++ * Interrupt setup is already guaranteed to be single-threaded, this is
++ * just to make the assert_spin_locked checks happy.
++ */
++ spin_lock_irq(&dev_priv->irq_lock);
++ if (dev_priv->display.hpd_irq_setup)
++ dev_priv->display.hpd_irq_setup(dev_priv->dev);
++ spin_unlock_irq(&dev_priv->irq_lock);
++}
++
++void i915_hpd_poll_init_work(struct work_struct *work) {
++ struct drm_i915_private *dev_priv =
++ container_of(work, struct drm_i915_private,
++ hotplug.poll_init_work);
++ struct drm_device *dev = dev_priv->dev;
++ struct drm_mode_config *mode_config = &dev->mode_config;
++ struct drm_connector *connector;
++ bool enabled;
++
++ mutex_lock(&dev->mode_config.mutex);
++
++ enabled = READ_ONCE(dev_priv->hotplug.poll_enabled);
++
+ list_for_each_entry(connector, &mode_config->connector_list, head) {
+- struct intel_connector *intel_connector = to_intel_connector(connector);
++ struct intel_connector *intel_connector =
++ to_intel_connector(connector);
+ connector->polled = intel_connector->polled;
+
+ /* MST has a dynamic intel_connector->encoder and it's reprobing
+@@ -475,24 +502,62 @@ void intel_hpd_init(struct drm_i915_priv
+ continue;
+
+ if (!connector->polled && I915_HAS_HOTPLUG(dev) &&
+- intel_connector->encoder->hpd_pin > HPD_NONE)
+- connector->polled = DRM_CONNECTOR_POLL_HPD;
++ intel_connector->encoder->hpd_pin > HPD_NONE) {
++ connector->polled = enabled ?
++ DRM_CONNECTOR_POLL_CONNECT |
++ DRM_CONNECTOR_POLL_DISCONNECT :
++ DRM_CONNECTOR_POLL_HPD;
++ }
+ }
+
++ if (enabled)
++ drm_kms_helper_poll_enable_locked(dev);
++
++ mutex_unlock(&dev->mode_config.mutex);
++
+ /*
+- * Interrupt setup is already guaranteed to be single-threaded, this is
+- * just to make the assert_spin_locked checks happy.
++ * We might have missed any hotplugs that happened while we were
++ * in the middle of disabling polling
+ */
+- spin_lock_irq(&dev_priv->irq_lock);
+- if (dev_priv->display.hpd_irq_setup)
+- dev_priv->display.hpd_irq_setup(dev);
+- spin_unlock_irq(&dev_priv->irq_lock);
++ if (!enabled)
++ drm_helper_hpd_irq_event(dev);
++}
++
++/**
++ * intel_hpd_poll_init - enables/disables polling for connectors with hpd
++ * @dev_priv: i915 device instance
++ * @enabled: Whether to enable or disable polling
++ *
++ * This function enables polling for all connectors, regardless of whether or
++ * not they support hotplug detection. Under certain conditions HPD may not be
++ * functional. On most Intel GPUs, this happens when we enter runtime suspend.
++ * On Valleyview and Cherryview systems, this also happens when we shut off all
++ * of the powerwells.
++ *
++ * Since this function can get called in contexts where we're already holding
++ * dev->mode_config.mutex, we do the actual hotplug enabling in a seperate
++ * worker.
++ *
++ * Also see: intel_hpd_init(), which restores hpd handling.
++ */
++void intel_hpd_poll_init(struct drm_i915_private *dev_priv)
++{
++ WRITE_ONCE(dev_priv->hotplug.poll_enabled, true);
++
++ /*
++ * We might already be holding dev->mode_config.mutex, so do this in a
++ * seperate worker
++ * As well, there's no issue if we race here since we always reschedule
++ * this worker anyway
++ */
++ schedule_work(&dev_priv->hotplug.poll_init_work);
+ }
+
+ void intel_hpd_init_work(struct drm_i915_private *dev_priv)
+ {
+ INIT_WORK(&dev_priv->hotplug.hotplug_work, i915_hotplug_work_func);
+ INIT_WORK(&dev_priv->hotplug.dig_port_work, i915_digport_work_func);
++ INIT_WORK(&dev_priv->hotplug.poll_init_work, i915_hpd_poll_init_work);
+ INIT_DELAYED_WORK(&dev_priv->hotplug.reenable_work,
+ intel_hpd_irq_storm_reenable_work);
+ }
+@@ -509,6 +574,7 @@ void intel_hpd_cancel_work(struct drm_i9
+
+ cancel_work_sync(&dev_priv->hotplug.dig_port_work);
+ cancel_work_sync(&dev_priv->hotplug.hotplug_work);
++ cancel_work_sync(&dev_priv->hotplug.poll_init_work);
+ cancel_delayed_work_sync(&dev_priv->hotplug.reenable_work);
+ }
+
+--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
+@@ -1007,6 +1007,8 @@ static void vlv_display_power_well_deini
+ synchronize_irq(dev_priv->dev->irq);
+
+ vlv_power_sequencer_reset(dev_priv);
++
++ intel_hpd_poll_init(dev_priv);
+ }
+
+ static void vlv_display_power_well_enable(struct drm_i915_private *dev_priv,
--- /dev/null
+From 3871f42a57efcdc6a9da751a8cb6fa196c212289 Mon Sep 17 00:00:00 2001
+From: Matthew Auld <matthew.auld@intel.com>
+Date: Fri, 5 Aug 2016 19:04:40 +0100
+Subject: drm/i915: fix aliasing_ppgtt leak
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+commit 3871f42a57efcdc6a9da751a8cb6fa196c212289 upstream.
+
+In i915_ggtt_cleanup_hw we need to remember to free aliasing_ppgtt. This
+fixes the following kmemleak message:
+
+unreferenced object 0xffff880213cca000 (size 8192):
+ comm "modprobe", pid 1298, jiffies 4294745402 (age 703.930s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<ffffffff817c808e>] kmemleak_alloc+0x4e/0xb0
+ [<ffffffff8121f9c2>] kmem_cache_alloc_trace+0x142/0x1d0
+ [<ffffffffa06d11ef>] i915_gem_init_ggtt+0x10f/0x210 [i915]
+ [<ffffffffa06d71bb>] i915_gem_init+0x5b/0xd0 [i915]
+ [<ffffffffa069749a>] i915_driver_load+0x97a/0x1460 [i915]
+ [<ffffffffa06a26ef>] i915_pci_probe+0x4f/0x70 [i915]
+ [<ffffffff81423015>] local_pci_probe+0x45/0xa0
+ [<ffffffff81424463>] pci_device_probe+0x103/0x150
+ [<ffffffff81515e6c>] driver_probe_device+0x22c/0x440
+ [<ffffffff81516151>] __driver_attach+0xd1/0xf0
+ [<ffffffff8151379c>] bus_for_each_dev+0x6c/0xc0
+ [<ffffffff8151555e>] driver_attach+0x1e/0x20
+ [<ffffffff81514fa3>] bus_add_driver+0x1c3/0x280
+ [<ffffffff81516aa0>] driver_register+0x60/0xe0
+ [<ffffffff8142297c>] __pci_register_driver+0x4c/0x50
+ [<ffffffffa013605b>] 0xffffffffa013605b
+
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Fixes: b18b6bde300e ("drm/i915/bdw: Free PPGTT struct")
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1470420280-21417-1-git-send-email-matthew.auld@intel.com
+(cherry picked from commit cb7f27601c81a1e0454e9461e96f65b31fafbea0)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_gem_gtt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
++++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
+@@ -2826,6 +2826,7 @@ void i915_ggtt_cleanup_hw(struct drm_dev
+ struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt;
+
+ ppgtt->base.cleanup(&ppgtt->base);
++ kfree(ppgtt);
+ }
+
+ i915_gem_cleanup_stolen(dev);
--- /dev/null
+From 5728e0de741a3581e9900c5cbee3a51425daf211 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 12 Jul 2016 15:59:28 +0300
+Subject: drm/i915: Fix iboost setting for DDI with 4 lanes on SKL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 5728e0de741a3581e9900c5cbee3a51425daf211 upstream.
+
+Bspec says:
+"For DDIA with x4 capability (DDI_BUF_CTL DDIA Lane Capability Control =
+ DDIA x4), the I_boost value has to be programmed in both
+ tx_blnclegsctl_0 and tx_blnclegsctl_4."
+
+Currently we only program tx_blnclegsctl_0. Let's do the other one as
+well.
+
+Fixes: f8896f5d58e6 ("drm/i915/skl: Buffer translation improvements")
+Cc: David Weinehall <david.weinehall@linux.intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1468328376-6380-2-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: David Weinehall <david.weinehall@linux.intel.com>
+(cherry picked from commit a7d8dbc07c8f0faaace983b1e4c6e9495dd0aa75)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/i915_reg.h | 1 +
+ drivers/gpu/drm/i915/intel_ddi.c | 36 +++++++++++++++++++++++-------------
+ 2 files changed, 24 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -1522,6 +1522,7 @@ enum skl_disp_power_wells {
+ #define BALANCE_LEG_MASK(port) (7<<(8+3*(port)))
+ /* Balance leg disable bits */
+ #define BALANCE_LEG_DISABLE_SHIFT 23
++#define BALANCE_LEG_DISABLE(port) (1 << (23 + (port)))
+
+ /*
+ * Fence registers
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -1371,14 +1371,30 @@ void intel_ddi_disable_pipe_clock(struct
+ TRANS_CLK_SEL_DISABLED);
+ }
+
+-static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
+- u32 level, enum port port, int type)
++static void _skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
++ enum port port, uint8_t iboost)
+ {
++ u32 tmp;
++
++ tmp = I915_READ(DISPIO_CR_TX_BMU_CR0);
++ tmp &= ~(BALANCE_LEG_MASK(port) | BALANCE_LEG_DISABLE(port));
++ if (iboost)
++ tmp |= iboost << BALANCE_LEG_SHIFT(port);
++ else
++ tmp |= BALANCE_LEG_DISABLE(port);
++ I915_WRITE(DISPIO_CR_TX_BMU_CR0, tmp);
++}
++
++static void skl_ddi_set_iboost(struct intel_encoder *encoder, u32 level)
++{
++ struct intel_digital_port *intel_dig_port = enc_to_dig_port(&encoder->base);
++ struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev);
++ enum port port = intel_dig_port->port;
++ int type = encoder->type;
+ const struct ddi_buf_trans *ddi_translations;
+ uint8_t iboost;
+ uint8_t dp_iboost, hdmi_iboost;
+ int n_entries;
+- u32 reg;
+
+ /* VBT may override standard boost values */
+ dp_iboost = dev_priv->vbt.ddi_port_info[port].dp_boost_level;
+@@ -1420,16 +1436,10 @@ static void skl_ddi_set_iboost(struct dr
+ return;
+ }
+
+- reg = I915_READ(DISPIO_CR_TX_BMU_CR0);
+- reg &= ~BALANCE_LEG_MASK(port);
+- reg &= ~(1 << (BALANCE_LEG_DISABLE_SHIFT + port));
+-
+- if (iboost)
+- reg |= iboost << BALANCE_LEG_SHIFT(port);
+- else
+- reg |= 1 << (BALANCE_LEG_DISABLE_SHIFT + port);
++ _skl_ddi_set_iboost(dev_priv, port, iboost);
+
+- I915_WRITE(DISPIO_CR_TX_BMU_CR0, reg);
++ if (port == PORT_A && intel_dig_port->max_lanes == 4)
++ _skl_ddi_set_iboost(dev_priv, PORT_E, iboost);
+ }
+
+ static void bxt_ddi_vswing_sequence(struct drm_i915_private *dev_priv,
+@@ -1560,7 +1570,7 @@ uint32_t ddi_signal_levels(struct intel_
+ level = translate_signal_level(signal_levels);
+
+ if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
+- skl_ddi_set_iboost(dev_priv, level, port, encoder->type);
++ skl_ddi_set_iboost(encoder, level);
+ else if (IS_BROXTON(dev_priv))
+ bxt_ddi_vswing_sequence(dev_priv, level, port, encoder->type);
+
--- /dev/null
+From 85bf59d188721dca37bc8276457e68351213f38f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 2 Aug 2016 15:21:57 +0300
+Subject: drm/i915: Fix iboost setting for SKL Y/U DP DDI buffer translation entry 2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 85bf59d188721dca37bc8276457e68351213f38f upstream.
+
+The spec was recently fixed to have the correct iboost setting for the
+SKL Y/U DP DDI buffer translation table entry 2. Update our tables
+to match.
+
+Cc: David Weinehall <david.weinehall@linux.intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1470140517-13011-1-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: David Weinehall <david.weinehall@linux.intel.com>
+(cherry picked from commit 5ac9056753e79ac5ad1ccc3c99b311688e46e8c9)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ddi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -145,7 +145,7 @@ static const struct ddi_buf_trans skl_dd
+ static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = {
+ { 0x0000201B, 0x000000A2, 0x0 },
+ { 0x00005012, 0x00000088, 0x0 },
+- { 0x80007011, 0x000000CD, 0x0 },
++ { 0x80007011, 0x000000CD, 0x1 },
+ { 0x80009010, 0x000000C0, 0x1 },
+ { 0x0000201B, 0x0000009D, 0x0 },
+ { 0x80005012, 0x000000C0, 0x1 },
+@@ -158,7 +158,7 @@ static const struct ddi_buf_trans skl_u_
+ static const struct ddi_buf_trans skl_y_ddi_translations_dp[] = {
+ { 0x00000018, 0x000000A2, 0x0 },
+ { 0x00005012, 0x00000088, 0x0 },
+- { 0x80007011, 0x000000CD, 0x0 },
++ { 0x80007011, 0x000000CD, 0x3 },
+ { 0x80009010, 0x000000C0, 0x3 },
+ { 0x00000018, 0x0000009D, 0x0 },
+ { 0x80005012, 0x000000C0, 0x3 },
--- /dev/null
+From 7ff9a55614712adf13ce7990565be0263e620f5e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 12 Jul 2016 15:59:30 +0300
+Subject: drm/i915: Program iboost settings for HDMI/DVI on SKL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 7ff9a55614712adf13ce7990565be0263e620f5e upstream.
+
+Currently we fail to program the iboost stuff for HDMI/DVI. Let's remedy
+that.
+
+Fixes: f8896f5d58e6 ("drm/i915/skl: Buffer translation improvements")
+Cc: David Weinehall <david.weinehall@linux.intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1468328376-6380-4-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: David Weinehall <david.weinehall@linux.intel.com>
+(cherry picked from commit 8d8bb85eb7d859aa9bbe36e588690a1d22af7608)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_ddi.c | 51 ++++++++++++++++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_ddi.c
++++ b/drivers/gpu/drm/i915/intel_ddi.c
+@@ -388,6 +388,40 @@ skl_get_buf_trans_hdmi(struct drm_i915_p
+ }
+ }
+
++static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port)
++{
++ int n_hdmi_entries;
++ int hdmi_level;
++ int hdmi_default_entry;
++
++ hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
++
++ if (IS_BROXTON(dev_priv))
++ return hdmi_level;
++
++ if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) {
++ skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
++ hdmi_default_entry = 8;
++ } else if (IS_BROADWELL(dev_priv)) {
++ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
++ hdmi_default_entry = 7;
++ } else if (IS_HASWELL(dev_priv)) {
++ n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
++ hdmi_default_entry = 6;
++ } else {
++ WARN(1, "ddi translation table missing\n");
++ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
++ hdmi_default_entry = 7;
++ }
++
++ /* Choose a good default if VBT is badly populated */
++ if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
++ hdmi_level >= n_hdmi_entries)
++ hdmi_level = hdmi_default_entry;
++
++ return hdmi_level;
++}
++
+ /*
+ * Starting with Haswell, DDI port buffers must be programmed with correct
+ * values in advance. The buffer values are different for FDI and DP modes,
+@@ -399,7 +433,7 @@ void intel_prepare_ddi_buffer(struct int
+ {
+ struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
+ u32 iboost_bit = 0;
+- int i, n_hdmi_entries, n_dp_entries, n_edp_entries, hdmi_default_entry,
++ int i, n_hdmi_entries, n_dp_entries, n_edp_entries,
+ size;
+ int hdmi_level;
+ enum port port;
+@@ -410,7 +444,7 @@ void intel_prepare_ddi_buffer(struct int
+ const struct ddi_buf_trans *ddi_translations;
+
+ port = intel_ddi_get_encoder_port(encoder);
+- hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
++ hdmi_level = intel_ddi_hdmi_level(dev_priv, port);
+
+ if (IS_BROXTON(dev_priv)) {
+ if (encoder->type != INTEL_OUTPUT_HDMI)
+@@ -430,7 +464,6 @@ void intel_prepare_ddi_buffer(struct int
+ skl_get_buf_trans_edp(dev_priv, &n_edp_entries);
+ ddi_translations_hdmi =
+ skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
+- hdmi_default_entry = 8;
+ /* If we're boosting the current, set bit 31 of trans1 */
+ if (dev_priv->vbt.ddi_port_info[port].hdmi_boost_level ||
+ dev_priv->vbt.ddi_port_info[port].dp_boost_level)
+@@ -456,7 +489,6 @@ void intel_prepare_ddi_buffer(struct int
+
+ n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
+ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
+- hdmi_default_entry = 7;
+ } else if (IS_HASWELL(dev_priv)) {
+ ddi_translations_fdi = hsw_ddi_translations_fdi;
+ ddi_translations_dp = hsw_ddi_translations_dp;
+@@ -464,7 +496,6 @@ void intel_prepare_ddi_buffer(struct int
+ ddi_translations_hdmi = hsw_ddi_translations_hdmi;
+ n_dp_entries = n_edp_entries = ARRAY_SIZE(hsw_ddi_translations_dp);
+ n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
+- hdmi_default_entry = 6;
+ } else {
+ WARN(1, "ddi translation table missing\n");
+ ddi_translations_edp = bdw_ddi_translations_dp;
+@@ -474,7 +505,6 @@ void intel_prepare_ddi_buffer(struct int
+ n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp);
+ n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
+ n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
+- hdmi_default_entry = 7;
+ }
+
+ switch (encoder->type) {
+@@ -505,11 +535,6 @@ void intel_prepare_ddi_buffer(struct int
+ if (encoder->type != INTEL_OUTPUT_HDMI)
+ return;
+
+- /* Choose a good default if VBT is badly populated */
+- if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
+- hdmi_level >= n_hdmi_entries)
+- hdmi_level = hdmi_default_entry;
+-
+ /* Entry 9 is for HDMI: */
+ I915_WRITE(DDI_BUF_TRANS_LO(port, i),
+ ddi_translations_hdmi[hdmi_level].trans1 | iboost_bit);
+@@ -1639,6 +1664,10 @@ static void intel_ddi_pre_enable(struct
+ intel_dp_stop_link_train(intel_dp);
+ } else if (type == INTEL_OUTPUT_HDMI) {
+ struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
++ int level = intel_ddi_hdmi_level(dev_priv, port);
++
++ if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
++ skl_ddi_set_iboost(intel_encoder, level);
+
+ intel_hdmi->set_infoframes(encoder,
+ crtc->config->has_hdmi_sink,
--- /dev/null
+From 21842ea84f161ae37ba25f0250c377fd19c5b307 Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Tue, 21 Jun 2016 17:03:43 -0400
+Subject: drm/i915/vlv: Disable HPD in valleyview_crt_detect_hotplug()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude <cpaul@redhat.com>
+
+commit 21842ea84f161ae37ba25f0250c377fd19c5b307 upstream.
+
+One of the things preventing us from using polling is the fact that
+calling valleyview_crt_detect_hotplug() when there's a VGA cable
+connected results in sending another hotplug. With polling enabled when
+HPD is disabled, this results in a scenario like this:
+
+- We enable power wells and reset the ADPA
+- output_poll_exec does force probe on VGA, triggering a hpd
+- HPD handler waits for poll to unlock dev->mode_config.mutex
+- output_poll_exec shuts off the ADPA, unlocks dev->mode_config.mutex
+- HPD handler runs, resets ADPA and brings us back to the start
+
+This results in an endless irq storm getting sent from the ADPA
+whenever a VGA connector gets detected in the middle of polling.
+
+Somewhat based off of the "drm/i915: Disable CRT HPD around force
+trigger" patch Ville Syrjälä sent a while back
+
+Cc: stable@vger.kernel.org
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Lyude <cpaul@redhat.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+(cherry picked from commit b236d7c8421969ac0693fc571e47ee5c2a62fb90)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_drv.h | 2 ++
+ drivers/gpu/drm/i915/intel_crt.c | 18 ++++++++++++++++++
+ drivers/gpu/drm/i915/intel_hotplug.c | 27 +++++++++++++++++++++++++++
+ 3 files changed, 47 insertions(+)
+
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -2791,6 +2791,8 @@ void intel_hpd_init(struct drm_i915_priv
+ void intel_hpd_init_work(struct drm_i915_private *dev_priv);
+ void intel_hpd_cancel_work(struct drm_i915_private *dev_priv);
+ bool intel_hpd_pin_to_port(enum hpd_pin pin, enum port *port);
++bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin);
++void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin);
+
+ /* i915_irq.c */
+ void i915_queue_hangcheck(struct drm_device *dev);
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -327,10 +327,25 @@ static bool valleyview_crt_detect_hotplu
+ struct drm_device *dev = connector->dev;
+ struct intel_crt *crt = intel_attached_crt(connector);
+ struct drm_i915_private *dev_priv = dev->dev_private;
++ bool reenable_hpd;
+ u32 adpa;
+ bool ret;
+ u32 save_adpa;
+
++ /*
++ * Doing a force trigger causes a hpd interrupt to get sent, which can
++ * get us stuck in a loop if we're polling:
++ * - We enable power wells and reset the ADPA
++ * - output_poll_exec does force probe on VGA, triggering a hpd
++ * - HPD handler waits for poll to unlock dev->mode_config.mutex
++ * - output_poll_exec shuts off the ADPA, unlocks
++ * dev->mode_config.mutex
++ * - HPD handler runs, resets ADPA and brings us back to the start
++ *
++ * Just disable HPD interrupts here to prevent this
++ */
++ reenable_hpd = intel_hpd_disable(dev_priv, crt->base.hpd_pin);
++
+ save_adpa = adpa = I915_READ(crt->adpa_reg);
+ DRM_DEBUG_KMS("trigger hotplug detect cycle: adpa=0x%x\n", adpa);
+
+@@ -353,6 +368,9 @@ static bool valleyview_crt_detect_hotplu
+
+ DRM_DEBUG_KMS("valleyview hotplug adpa=0x%x, result %d\n", adpa, ret);
+
++ if (reenable_hpd)
++ intel_hpd_enable(dev_priv, crt->base.hpd_pin);
++
+ return ret;
+ }
+
+--- a/drivers/gpu/drm/i915/intel_hotplug.c
++++ b/drivers/gpu/drm/i915/intel_hotplug.c
+@@ -511,3 +511,30 @@ void intel_hpd_cancel_work(struct drm_i9
+ cancel_work_sync(&dev_priv->hotplug.hotplug_work);
+ cancel_delayed_work_sync(&dev_priv->hotplug.reenable_work);
+ }
++
++bool intel_hpd_disable(struct drm_i915_private *dev_priv, enum hpd_pin pin)
++{
++ bool ret = false;
++
++ if (pin == HPD_NONE)
++ return false;
++
++ spin_lock_irq(&dev_priv->irq_lock);
++ if (dev_priv->hotplug.stats[pin].state == HPD_ENABLED) {
++ dev_priv->hotplug.stats[pin].state = HPD_DISABLED;
++ ret = true;
++ }
++ spin_unlock_irq(&dev_priv->irq_lock);
++
++ return ret;
++}
++
++void intel_hpd_enable(struct drm_i915_private *dev_priv, enum hpd_pin pin)
++{
++ if (pin == HPD_NONE)
++ return;
++
++ spin_lock_irq(&dev_priv->irq_lock);
++ dev_priv->hotplug.stats[pin].state = HPD_ENABLED;
++ spin_unlock_irq(&dev_priv->irq_lock);
++}
--- /dev/null
+From 4570d833390b10043d082fe535375d4a0e071d9c Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Tue, 21 Jun 2016 17:03:41 -0400
+Subject: drm/i915/vlv: Make intel_crt_reset() per-encoder
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude <cpaul@redhat.com>
+
+commit 4570d833390b10043d082fe535375d4a0e071d9c upstream.
+
+This lets call intel_crt_reset() in contexts where IRQs are disabled and
+as such, can't hold the locks required to work with the connectors.
+
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Lyude <cpaul@redhat.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+(cherry picked from commit 28cf71ce3e206db1c3f30b3da31e7b48b2269e4c)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/gpu/drm/i915/intel_crt.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -713,11 +713,11 @@ static int intel_crt_set_property(struct
+ return 0;
+ }
+
+-static void intel_crt_reset(struct drm_connector *connector)
++static void intel_crt_reset(struct drm_encoder *encoder)
+ {
+- struct drm_device *dev = connector->dev;
++ struct drm_device *dev = encoder->dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
+- struct intel_crt *crt = intel_attached_crt(connector);
++ struct intel_crt *crt = intel_encoder_to_crt(to_intel_encoder(encoder));
+
+ if (INTEL_INFO(dev)->gen >= 5) {
+ u32 adpa;
+@@ -739,7 +739,6 @@ static void intel_crt_reset(struct drm_c
+ */
+
+ static const struct drm_connector_funcs intel_crt_connector_funcs = {
+- .reset = intel_crt_reset,
+ .dpms = drm_atomic_helper_connector_dpms,
+ .detect = intel_crt_detect,
+ .fill_modes = drm_helper_probe_single_connector_modes,
+@@ -757,6 +756,7 @@ static const struct drm_connector_helper
+ };
+
+ static const struct drm_encoder_funcs intel_crt_enc_funcs = {
++ .reset = intel_crt_reset,
+ .destroy = intel_encoder_destroy,
+ };
+
+@@ -902,5 +902,5 @@ void intel_crt_init(struct drm_device *d
+ dev_priv->fdi_rx_config = I915_READ(FDI_RX_CTL(PIPE_A)) & fdi_config;
+ }
+
+- intel_crt_reset(connector);
++ intel_crt_reset(&crt->base.base);
+ }
--- /dev/null
+From 4c732e6ee9e71903934d75b12a021eb3520b6197 Mon Sep 17 00:00:00 2001
+From: Lyude <cpaul@redhat.com>
+Date: Tue, 21 Jun 2016 17:03:42 -0400
+Subject: drm/i915/vlv: Reset the ADPA in vlv_display_power_well_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lyude <cpaul@redhat.com>
+
+commit 4c732e6ee9e71903934d75b12a021eb3520b6197 upstream.
+
+While VGA hotplugging worked(ish) before, it looks like that was mainly
+because we'd unintentionally enable it in
+valleyview_crt_detect_hotplug() when we did a force trigger. This
+doesn't work reliably enough because whenever the display powerwell on
+vlv gets disabled, the values set in VLV_ADPA get cleared and
+consequently VGA hotplugging gets disabled. This causes bugs such as one
+we found on an Intel NUC, where doing the following sequence of
+hotplugs:
+
+ - Disconnect all monitors
+ - Connect VGA
+ - Disconnect VGA
+ - Connect HDMI
+
+Would result in VGA hotplugging becoming disabled, due to the powerwells
+getting toggled in the process of connecting HDMI.
+
+Changes since v3:
+ - Expose intel_crt_reset() through intel_drv.h and call that in
+ vlv_display_power_well_init() instead of
+ encoder->base.funcs->reset(&encoder->base);
+
+Changes since v2:
+ - Use intel_encoder structs instead of drm_encoder structs
+
+Changes since v1:
+ - Instead of handling the register writes ourself, we just reuse
+ intel_crt_detect()
+ - Instead of resetting the ADPA during display IRQ installation, we now
+ reset them in vlv_display_power_well_init()
+
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Lyude <cpaul@redhat.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+[danvet: Rebase over dev_priv/drm_device embedding.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+(cherry picked from commit 9504a89247595b6c066c68aea0c34af1fc78d021)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_crt.c | 2 +-
+ drivers/gpu/drm/i915/intel_drv.h | 2 +-
+ drivers/gpu/drm/i915/intel_runtime_pm.c | 7 +++++++
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -713,7 +713,7 @@ static int intel_crt_set_property(struct
+ return 0;
+ }
+
+-static void intel_crt_reset(struct drm_encoder *encoder)
++void intel_crt_reset(struct drm_encoder *encoder)
+ {
+ struct drm_device *dev = encoder->dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -1052,7 +1052,7 @@ void gen8_irq_power_well_pre_disable(str
+
+ /* intel_crt.c */
+ void intel_crt_init(struct drm_device *dev);
+-
++void intel_crt_reset(struct drm_encoder *encoder);
+
+ /* intel_ddi.c */
+ void intel_ddi_clk_select(struct intel_encoder *encoder,
+--- a/drivers/gpu/drm/i915/intel_runtime_pm.c
++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c
+@@ -952,6 +952,7 @@ static void vlv_init_display_clock_gatin
+
+ static void vlv_display_power_well_init(struct drm_i915_private *dev_priv)
+ {
++ struct intel_encoder *encoder;
+ enum pipe pipe;
+
+ /*
+@@ -987,6 +988,12 @@ static void vlv_display_power_well_init(
+
+ intel_hpd_init(dev_priv);
+
++ /* Re-enable the ADPA, if we have one */
++ for_each_intel_encoder(dev_priv->dev, encoder) {
++ if (encoder->type == INTEL_OUTPUT_ANALOG)
++ intel_crt_reset(&encoder->base);
++ }
++
+ i915_redisable_vga_power_on(dev_priv->dev);
+ }
+
--- /dev/null
+From c5b48fa7e298b9a8968a1c1fc0ef013069ca2dd2 Mon Sep 17 00:00:00 2001
+From: Lukasz Odzioba <lukasz.odzioba@intel.com>
+Date: Sat, 23 Jul 2016 01:44:49 +0200
+Subject: EDAC, sb_edac: Fix channel reporting on Knights Landing
+
+From: Lukasz Odzioba <lukasz.odzioba@intel.com>
+
+commit c5b48fa7e298b9a8968a1c1fc0ef013069ca2dd2 upstream.
+
+On Intel Xeon Phi Knights Landing processor family the channels of the
+memory controller have untypical arrangement - MC0 is mapped to CH3,4,5
+and MC1 is mapped to CH0,1,2. This causes the EDAC driver to report the
+channel name incorrectly.
+
+We missed this change earlier, so the code already contains similar
+comment, but the translation function is incorrect.
+
+Without this patch:
+ errors in DIMM_A and DIMM_D were reported in DIMM_D
+ errors in DIMM_B and DIMM_E were reported in DIMM_E
+ errors in DIMM_C and DIMM_F were reported in DIMM_F
+
+Correct this.
+
+Hubert Chrzaniuk:
+ - rebased to 4.8
+ - comments and code cleanup
+
+Fixes: d0cdf9003140 ("sb_edac: Add Knights Landing (Xeon Phi gen 2) support")
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Hubert Chrzaniuk <hubert.chrzaniuk@intel.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Cc: lukasz.anaczkowski@intel.com
+Cc: lukasz.odzioba@intel.com
+Cc: mchehab@kernel.org
+Link: http://lkml.kernel.org/r/1469231089-22837-1-git-send-email-lukasz.odzioba@intel.com
+Signed-off-by: Lukasz Odzioba <lukasz.odzioba@intel.com>
+[ Boris: Simplify a bit by removing char mc. ]
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/sb_edac.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -552,9 +552,9 @@ static const struct pci_id_table pci_dev
+ /* Knight's Landing Support */
+ /*
+ * KNL's memory channels are swizzled between memory controllers.
+- * MC0 is mapped to CH3,5,6 and MC1 is mapped to CH0,1,2
++ * MC0 is mapped to CH3,4,5 and MC1 is mapped to CH0,1,2
+ */
+-#define knl_channel_remap(channel) ((channel + 3) % 6)
++#define knl_channel_remap(mc, chan) ((mc) ? (chan) : (chan) + 3)
+
+ /* Memory controller, TAD tables, error injection - 2-8-0, 2-9-0 (2 of these) */
+ #define PCI_DEVICE_ID_INTEL_KNL_IMC_MC 0x7840
+@@ -1286,7 +1286,7 @@ static u32 knl_get_mc_route(int entry, u
+ mc = GET_BITFIELD(reg, entry*3, (entry*3)+2);
+ chan = GET_BITFIELD(reg, (entry*2) + 18, (entry*2) + 18 + 1);
+
+- return knl_channel_remap(mc*3 + chan);
++ return knl_channel_remap(mc, chan);
+ }
+
+ /*
+@@ -2997,8 +2997,15 @@ static void sbridge_mce_output_error(str
+ } else {
+ char A = *("A");
+
+- channel = knl_channel_remap(channel);
++ /*
++ * Reported channel is in range 0-2, so we can't map it
++ * back to mc. To figure out mc we check machine check
++ * bank register that reported this error.
++ * bank15 means mc0 and bank16 means mc1.
++ */
++ channel = knl_channel_remap(m->bank == 16, channel);
+ channel_mask = 1 << channel;
++
+ snprintf(msg, sizeof(msg),
+ "%s%s err_code:%04x:%04x channel:%d (DIMM_%c)",
+ overflow ? " OVERFLOW" : "",
--- /dev/null
+From 088bf2ff5d12e2e32ee52a4024fec26e582f44d3 Mon Sep 17 00:00:00 2001
+From: Vegard Nossum <vegard.nossum@oracle.com>
+Date: Thu, 25 Aug 2016 15:17:11 -0700
+Subject: fs/seq_file: fix out-of-bounds read
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+commit 088bf2ff5d12e2e32ee52a4024fec26e582f44d3 upstream.
+
+seq_read() is a nasty piece of work, not to mention buggy.
+
+It has (I think) an old bug which allows unprivileged userspace to read
+beyond the end of m->buf.
+
+I was getting these:
+
+ BUG: KASAN: slab-out-of-bounds in seq_read+0xcd2/0x1480 at addr ffff880116889880
+ Read of size 2713 by task trinity-c2/1329
+ CPU: 2 PID: 1329 Comm: trinity-c2 Not tainted 4.8.0-rc1+ #96
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
+ Call Trace:
+ kasan_object_err+0x1c/0x80
+ kasan_report_error+0x2cb/0x7e0
+ kasan_report+0x4e/0x80
+ check_memory_region+0x13e/0x1a0
+ kasan_check_read+0x11/0x20
+ seq_read+0xcd2/0x1480
+ proc_reg_read+0x10b/0x260
+ do_loop_readv_writev.part.5+0x140/0x2c0
+ do_readv_writev+0x589/0x860
+ vfs_readv+0x7b/0xd0
+ do_readv+0xd8/0x2c0
+ SyS_readv+0xb/0x10
+ do_syscall_64+0x1b3/0x4b0
+ entry_SYSCALL64_slow_path+0x25/0x25
+ Object at ffff880116889100, in cache kmalloc-4096 size: 4096
+ Allocated:
+ PID = 1329
+ save_stack_trace+0x26/0x80
+ save_stack+0x46/0xd0
+ kasan_kmalloc+0xad/0xe0
+ __kmalloc+0x1aa/0x4a0
+ seq_buf_alloc+0x35/0x40
+ seq_read+0x7d8/0x1480
+ proc_reg_read+0x10b/0x260
+ do_loop_readv_writev.part.5+0x140/0x2c0
+ do_readv_writev+0x589/0x860
+ vfs_readv+0x7b/0xd0
+ do_readv+0xd8/0x2c0
+ SyS_readv+0xb/0x10
+ do_syscall_64+0x1b3/0x4b0
+ return_from_SYSCALL_64+0x0/0x6a
+ Freed:
+ PID = 0
+ (stack is not available)
+ Memory state around the buggy address:
+ ffff88011688a000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ ffff88011688a080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ >ffff88011688a100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ^
+ ffff88011688a180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff88011688a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ==================================================================
+ Disabling lock debugging due to kernel taint
+
+This seems to be the same thing that Dave Jones was seeing here:
+
+ https://lkml.org/lkml/2016/8/12/334
+
+There are multiple issues here:
+
+ 1) If we enter the function with a non-empty buffer, there is an attempt
+ to flush it. But it was not clearing m->from after doing so, which
+ means that if we try to do this flush twice in a row without any call
+ to traverse() in between, we are going to be reading from the wrong
+ place -- the splat above, fixed by this patch.
+
+ 2) If there's a short write to userspace because of page faults, the
+ buffer may already contain multiple lines (i.e. pos has advanced by
+ more than 1), but we don't save the progress that was made so the
+ next call will output what we've already returned previously. Since
+ that is a much less serious issue (and I have a headache after
+ staring at seq_read() for the past 8 hours), I'll leave that for now.
+
+Link: http://lkml.kernel.org/r/1471447270-32093-1-git-send-email-vegard.nossum@oracle.com
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Reported-by: Dave Jones <davej@codemonkey.org.uk>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/seq_file.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/seq_file.c
++++ b/fs/seq_file.c
+@@ -223,8 +223,10 @@ ssize_t seq_read(struct file *file, char
+ size -= n;
+ buf += n;
+ copied += n;
+- if (!m->count)
++ if (!m->count) {
++ m->from = 0;
+ m->index++;
++ }
+ if (!size)
+ goto Done;
+ }
--- /dev/null
+From 2527ecc9195e9c66252af24c4689e8a67cd4ccb9 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Tue, 16 Aug 2016 09:58:25 +0200
+Subject: gpio: Fix OF build problem on UM
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 2527ecc9195e9c66252af24c4689e8a67cd4ccb9 upstream.
+
+The UserMode (UM) Linux build was failing in gpiolib-of as it requires
+ioremap()/iounmap() to exist, which is absent from UM. The non-existence
+of IO memory is negatively defined as CONFIG_NO_IOMEM which means we
+need to depend on HAS_IOMEM.
+
+Cc: Geert Uytterhoeven <geert@linux-m68k.org>
+Reported-by: kbuild test robot <fengguang.wu@intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpio/Kconfig
++++ b/drivers/gpio/Kconfig
+@@ -50,6 +50,7 @@ config GPIO_DEVRES
+ config OF_GPIO
+ def_bool y
+ depends on OF
++ depends on HAS_IOMEM
+
+ config GPIO_ACPI
+ def_bool y
--- /dev/null
+From 6f4deb18a505523eb7925d646574a95f9e982ff7 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Mon, 8 Aug 2016 15:58:56 +0200
+Subject: gpio: max730x: set gpiochip data pointer before using it
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit 6f4deb18a505523eb7925d646574a95f9e982ff7 upstream.
+
+gpiochip_add_data() has to be called before calling
+max7301_direction_input()
+
+[ 4.389883] Unable to handle kernel paging request for data at address 0x00000018
+[ 4.397282] Faulting instruction address: 0xc01a8cbc
+[ 4.402023] Oops: Kernel access of bad area, sig: 11 [#1]
+[ 4.407331] PREEMPT CMPC885
+[ 4.410131] CPU: 0 PID: 6 Comm: kworker/u2:0 Not tainted 4.5.0-gacdfdee #39
+[ 4.418592] Workqueue: deferwq deferred_probe_work_func
+[ 4.423711] task: c60798b0 ti: c608a000 task.ti: c608a000
+[ 4.429038] NIP: c01a8cbc LR: c01a8e24 CTR: c01ff028
+[ 4.433953] REGS: c608bad0 TRAP: 0300 Not tainted (4.5.0-s3k-dev-gacdfdee-svn-dirty)
+[ 4.441847] MSR: 00009032 <EE,ME,IR,DR,RI> CR: 33039553 XER: a000f940
+[ 4.448395] DAR: 00000018 DSISR: c0000000
+GPR00: c01a8e24 c608bb80 c60798b0 c60d6f6c 00000004 00000002 07de2900 00700000
+GPR08: 00000000 00000000 c608a000 00001032 35039553 00000000 c002f37c c6010b64
+GPR16: c6010a48 c6010a14 c6010a00 00000000 c0450000 c0453568 c0453438 c050db14
+GPR24: c62662bc 00000009 ffffffaa c60d6f5d 00000001 00000000 00000000 00000000
+[ 4.480371] NIP [c01a8cbc] max7301_direction_input+0x20/0x9c
+[ 4.485951] LR [c01a8e24] __max730x_probe+0xec/0x138
+[ 4.490812] Call Trace:
+[ 4.493268] [c608bba0] [c01a8e24] __max730x_probe+0xec/0x138
+[ 4.498878] [c608bbc0] [c01cc368] driver_probe_device+0x190/0x38c
+[ 4.504895] [c608bbf0] [c01ca918] bus_for_each_drv+0x58/0xb4
+[ 4.510489] [c608bc20] [c01cc04c] __device_attach+0x8c/0x110
+[ 4.516082] [c608bc50] [c01cab80] bus_probe_device+0x34/0xb8
+[ 4.521673] [c608bc70] [c01c96c8] device_add+0x3c0/0x598
+[ 4.526925] [c608bcb0] [c0200f90] spi_add_device+0x114/0x160
+[ 4.532512] [c608bcd0] [c02018d0] spi_register_master+0x6e0/0x7c8
+[ 4.538537] [c608bd20] [c02019fc] devm_spi_register_master+0x44/0x8c
+[ 4.544824] [c608bd40] [c0203854] of_fsl_spi_probe+0x458/0x57c
+[ 4.550587] [c608bda0] [c01cd828] platform_drv_probe+0x30/0x74
+[ 4.556366] [c608bdb0] [c01cc368] driver_probe_device+0x190/0x38c
+[ 4.562383] [c608bde0] [c01ca918] bus_for_each_drv+0x58/0xb4
+[ 4.567977] [c608be10] [c01cc04c] __device_attach+0x8c/0x110
+[ 4.573572] [c608be40] [c01cab80] bus_probe_device+0x34/0xb8
+[ 4.579170] [c608be60] [c01cb9b4] deferred_probe_work_func+0xa4/0xc4
+[ 4.585438] [c608be80] [c0029c04] process_one_work+0x22c/0x414
+[ 4.591201] [c608bea0] [c002a100] worker_thread+0x314/0x5c0
+[ 4.596722] [c608bef0] [c002f444] kthread+0xc8/0xcc
+[ 4.601538] [c608bf40] [c000af84] ret_from_kernel_thread+0x5c/0x64
+[ 4.607596] Instruction dump:
+[ 4.610530] 7c0803a6 bba10014 38210020 4e800020 7c0802a6 9421ffe0 38840004 bf810010
+[ 4.618188] 90010024 549cf0be 83c30010 549d0f7c <813e0018> 7fc3f378 7d3f2430 57ff07fe
+[ 4.626041] ---[ end trace 303adb021dd4caf2 ]---
+
+fixes: 5e45e01916197 ("gpio: max730x: use gpiochip data pointer")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-max730x.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpio/gpio-max730x.c
++++ b/drivers/gpio/gpio-max730x.c
+@@ -192,6 +192,10 @@ int __max730x_probe(struct max7301 *ts)
+ ts->chip.parent = dev;
+ ts->chip.owner = THIS_MODULE;
+
++ ret = gpiochip_add_data(&ts->chip, ts);
++ if (ret)
++ goto exit_destroy;
++
+ /*
+ * initialize pullups according to platform data and cache the
+ * register values for later use.
+@@ -213,10 +217,6 @@ int __max730x_probe(struct max7301 *ts)
+ }
+ }
+
+- ret = gpiochip_add_data(&ts->chip, ts);
+- if (ret)
+- goto exit_destroy;
+-
+ return ret;
+
+ exit_destroy:
--- /dev/null
+From 4d01d88019261d05ec3bff5f1a6013393faa3b9e Mon Sep 17 00:00:00 2001
+From: Brian Norris <briannorris@chromium.org>
+Date: Wed, 10 Aug 2016 13:37:18 -0700
+Subject: i2c: cros-ec-tunnel: Fix usage of cros_ec_cmd_xfer()
+
+From: Brian Norris <briannorris@chromium.org>
+
+commit 4d01d88019261d05ec3bff5f1a6013393faa3b9e upstream.
+
+cros_ec_cmd_xfer returns success status if the command transport
+completes successfully, but the execution result is incorrectly ignored.
+In many cases, the execution result is assumed to be successful, leading
+to ignored errors and operating on uninitialized data.
+
+We've recently introduced the cros_ec_cmd_xfer_status() helper to avoid these
+problems. Let's use it.
+
+[Regarding the 'Fixes' tag; there is significant refactoring since the driver's
+introduction, but the underlying logical error exists throughout I believe]
+
+Fixes: 9d230c9e4f4e ("i2c: ChromeOS EC tunnel driver")
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-cros-ec-tunnel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
++++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
+@@ -215,7 +215,7 @@ static int ec_i2c_xfer(struct i2c_adapte
+ msg->outsize = request_len;
+ msg->insize = response_len;
+
+- result = cros_ec_cmd_xfer(bus->ec, msg);
++ result = cros_ec_cmd_xfer_status(bus->ec, msg);
+ if (result < 0) {
+ dev_err(dev, "Error transferring EC i2c message %d\n", result);
+ goto exit;
--- /dev/null
+From ce8cb803d8b90458495f23606c706f0c0c857cdc Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Fri, 12 Aug 2016 18:40:23 +0200
+Subject: i2c: mux: demux-pinctrl: properly roll back when adding adapter fails
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit ce8cb803d8b90458495f23606c706f0c0c857cdc upstream.
+
+We also need to revert the dynamic OF change, so we get a consistent
+state again. Otherwise, we might have two devices enabled e.g. after
+pinctrl setup fails.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
+@@ -68,7 +68,7 @@ static int i2c_demux_activate_master(str
+ adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
+ if (!adap) {
+ ret = -ENODEV;
+- goto err;
++ goto err_with_revert;
+ }
+
+ p = devm_pinctrl_get_select(adap->dev.parent, priv->bus_name);
+@@ -103,6 +103,8 @@ static int i2c_demux_activate_master(str
+
+ err_with_put:
+ i2c_put_adapter(adap);
++ err_with_revert:
++ of_changeset_revert(&priv->chan[new_chan].chgset);
+ err:
+ dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret);
+ return ret;
--- /dev/null
+From fcf68f3c0bb2a541aa47a2a38b8939edf84fd529 Mon Sep 17 00:00:00 2001
+From: Brian Norris <briannorris@chromium.org>
+Date: Mon, 8 Aug 2016 17:19:38 -0700
+Subject: iio: fix sched WARNING "do not call blocking ops when !TASK_RUNNING"
+
+From: Brian Norris <briannorris@chromium.org>
+
+commit fcf68f3c0bb2a541aa47a2a38b8939edf84fd529 upstream.
+
+When using CONFIG_DEBUG_ATOMIC_SLEEP, the scheduler nicely points out
+that we're calling sleeping primitives within the wait_event loop, which
+means we might clobber the task state:
+
+[ 10.831289] do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffc00026b610>]
+[ 10.845531] ------------[ cut here ]------------
+[ 10.850161] WARNING: at kernel/sched/core.c:7630
+...
+[ 12.164333] ---[ end trace 45409966a9a76438 ]---
+[ 12.168942] Call trace:
+[ 12.171391] [<ffffffc00024ed44>] __might_sleep+0x64/0x90
+[ 12.176699] [<ffffffc000954774>] mutex_lock_nested+0x50/0x3fc
+[ 12.182440] [<ffffffc0007b9424>] iio_kfifo_buf_data_available+0x28/0x4c
+[ 12.189043] [<ffffffc0007b76ac>] iio_buffer_ready+0x60/0xe0
+[ 12.194608] [<ffffffc0007b7834>] iio_buffer_read_first_n_outer+0x108/0x1a8
+[ 12.201474] [<ffffffc000370d48>] __vfs_read+0x58/0x114
+[ 12.206606] [<ffffffc000371740>] vfs_read+0x94/0x118
+[ 12.211564] [<ffffffc0003720f8>] SyS_read+0x64/0xb4
+[ 12.216436] [<ffffffc000203cb4>] el0_svc_naked+0x24/0x28
+
+To avoid this, we should (a la https://lwn.net/Articles/628628/) use the
+wait_woken() function, which avoids the nested sleeping while still
+handling races between waiting / wake-events.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/industrialio-buffer.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+--- a/drivers/iio/industrialio-buffer.c
++++ b/drivers/iio/industrialio-buffer.c
+@@ -107,6 +107,7 @@ ssize_t iio_buffer_read_first_n_outer(st
+ {
+ struct iio_dev *indio_dev = filp->private_data;
+ struct iio_buffer *rb = indio_dev->buffer;
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ size_t datum_size;
+ size_t to_wait;
+ int ret;
+@@ -131,19 +132,29 @@ ssize_t iio_buffer_read_first_n_outer(st
+ else
+ to_wait = min_t(size_t, n / datum_size, rb->watermark);
+
++ add_wait_queue(&rb->pollq, &wait);
+ do {
+- ret = wait_event_interruptible(rb->pollq,
+- iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size));
+- if (ret)
+- return ret;
+-
+- if (!indio_dev->info)
+- return -ENODEV;
++ if (!indio_dev->info) {
++ ret = -ENODEV;
++ break;
++ }
++
++ if (!iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)) {
++ if (signal_pending(current)) {
++ ret = -ERESTARTSYS;
++ break;
++ }
++
++ wait_woken(&wait, TASK_INTERRUPTIBLE,
++ MAX_SCHEDULE_TIMEOUT);
++ continue;
++ }
+
+ ret = rb->access->read_first_n(rb, n, buf);
+ if (ret == 0 && (filp->f_flags & O_NONBLOCK))
+ ret = -EAGAIN;
+ } while (ret == 0);
++ remove_wait_queue(&rb->pollq, &wait);
+
+ return ret;
+ }
--- /dev/null
+From 3714ce1d6655098ee69ede632883e5874d67e4ab Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 5 Aug 2016 19:49:45 +0100
+Subject: iommu/arm-smmu: Disable stalling faults for all endpoints
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 3714ce1d6655098ee69ede632883e5874d67e4ab upstream.
+
+Enabling stalling faults can result in hardware deadlock on poorly
+designed systems, particularly those with a PCI root complex upstream of
+the SMMU.
+
+Although it's not really Linux's job to save hardware integrators from
+their own misfortune, it *is* our job to stop userspace (e.g. VFIO
+clients) from hosing the system for everybody else, even if they might
+already be required to have elevated privileges.
+
+Given that the fault handling code currently executes entirely in IRQ
+context, there is nothing that can sensibly be done to recover from
+things like page faults anyway, so let's rip this code out for now and
+avoid the potential for deadlock.
+
+Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices")
+Reported-by: Matt Evans <matt.evans@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/arm-smmu.c | 34 +++++++---------------------------
+ 1 file changed, 7 insertions(+), 27 deletions(-)
+
+--- a/drivers/iommu/arm-smmu.c
++++ b/drivers/iommu/arm-smmu.c
+@@ -686,8 +686,7 @@ static struct iommu_gather_ops arm_smmu_
+
+ static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
+ {
+- int flags, ret;
+- u32 fsr, fsynr, resume;
++ u32 fsr, fsynr;
+ unsigned long iova;
+ struct iommu_domain *domain = dev;
+ struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
+@@ -701,34 +700,15 @@ static irqreturn_t arm_smmu_context_faul
+ if (!(fsr & FSR_FAULT))
+ return IRQ_NONE;
+
+- if (fsr & FSR_IGN)
+- dev_err_ratelimited(smmu->dev,
+- "Unexpected context fault (fsr 0x%x)\n",
+- fsr);
+-
+ fsynr = readl_relaxed(cb_base + ARM_SMMU_CB_FSYNR0);
+- flags = fsynr & FSYNR0_WNR ? IOMMU_FAULT_WRITE : IOMMU_FAULT_READ;
+-
+ iova = readq_relaxed(cb_base + ARM_SMMU_CB_FAR);
+- if (!report_iommu_fault(domain, smmu->dev, iova, flags)) {
+- ret = IRQ_HANDLED;
+- resume = RESUME_RETRY;
+- } else {
+- dev_err_ratelimited(smmu->dev,
+- "Unhandled context fault: iova=0x%08lx, fsynr=0x%x, cb=%d\n",
+- iova, fsynr, cfg->cbndx);
+- ret = IRQ_NONE;
+- resume = RESUME_TERMINATE;
+- }
+
+- /* Clear the faulting FSR */
+- writel(fsr, cb_base + ARM_SMMU_CB_FSR);
+-
+- /* Retry or terminate any stalled transactions */
+- if (fsr & FSR_SS)
+- writel_relaxed(resume, cb_base + ARM_SMMU_CB_RESUME);
++ dev_err_ratelimited(smmu->dev,
++ "Unhandled context fault: fsr=0x%x, iova=0x%08lx, fsynr=0x%x, cb=%d\n",
++ fsr, iova, fsynr, cfg->cbndx);
+
+- return ret;
++ writel(fsr, cb_base + ARM_SMMU_CB_FSR);
++ return IRQ_HANDLED;
+ }
+
+ static irqreturn_t arm_smmu_global_fault(int irq, void *dev)
+@@ -837,7 +817,7 @@ static void arm_smmu_init_context_bank(s
+ }
+
+ /* SCTLR */
+- reg = SCTLR_CFCFG | SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
++ reg = SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
+ if (stage1)
+ reg |= SCTLR_S1_ASIDPNE;
+ #ifdef __BIG_ENDIAN
--- /dev/null
+From 5bc0a11664e17e9f9551983f5b660bd48b57483c Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Tue, 16 Aug 2016 14:29:16 +0100
+Subject: iommu/arm-smmu: Don't BUG() if we find aborting STEs with disable_bypass
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 5bc0a11664e17e9f9551983f5b660bd48b57483c upstream.
+
+The disable_bypass cmdline option changes the SMMUv3 driver to put down
+faulting stream table entries by default, as opposed to bypassing
+transactions from unconfigured devices.
+
+In this mode of operation, it is entirely expected to see aborting
+entries in the stream table if and when we come to installing a valid
+translation, so don't trigger a BUG() as a result of misdiagnosing these
+entries as stream table corruption.
+
+Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices")
+Tested-by: Robin Murphy <robin.murphy@arm.com>
+Reported-by: Robin Murphy <robin.murphy@arm.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/arm-smmu-v3.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1034,6 +1034,9 @@ static void arm_smmu_write_strtab_ent(st
+ case STRTAB_STE_0_CFG_S2_TRANS:
+ ste_live = true;
+ break;
++ case STRTAB_STE_0_CFG_ABORT:
++ if (disable_bypass)
++ break;
+ default:
+ BUG(); /* STE corruption */
+ }
--- /dev/null
+From aea2037e0d3e23c3be1498feae29f71ca997d9e6 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 29 Jul 2016 11:15:37 +0100
+Subject: iommu/arm-smmu: Fix CMDQ error handling
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit aea2037e0d3e23c3be1498feae29f71ca997d9e6 upstream.
+
+In the unlikely event of a global command queue error, the ARM SMMUv3
+driver attempts to convert the problematic command into a CMD_SYNC and
+resume the command queue. Unfortunately, this code is pretty badly
+broken:
+
+ 1. It uses the index into the error string table as the CMDQ index,
+ so we probably read the wrong entry out of the queue
+
+ 2. The arguments to queue_write are the wrong way round, so we end up
+ writing from the queue onto the stack.
+
+These happily cancel out, so the kernel is likely to stay alive, but
+the command queue will probably fault again when we resume.
+
+This patch fixes the error handling code to use the correct queue index
+and write back the CMD_SYNC to the faulting entry.
+
+Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices")
+Reported-by: Diwakar Subraveti <Diwakar.Subraveti@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/arm-smmu-v3.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -879,7 +879,7 @@ static void arm_smmu_cmdq_skip_err(struc
+ * We may have concurrent producers, so we need to be careful
+ * not to touch any of the shadow cmdq state.
+ */
+- queue_read(cmd, Q_ENT(q, idx), q->ent_dwords);
++ queue_read(cmd, Q_ENT(q, cons), q->ent_dwords);
+ dev_err(smmu->dev, "skipping command in error state:\n");
+ for (i = 0; i < ARRAY_SIZE(cmd); ++i)
+ dev_err(smmu->dev, "\t0x%016llx\n", (unsigned long long)cmd[i]);
+@@ -890,7 +890,7 @@ static void arm_smmu_cmdq_skip_err(struc
+ return;
+ }
+
+- queue_write(cmd, Q_ENT(q, idx), q->ent_dwords);
++ queue_write(Q_ENT(q, cons), cmd, q->ent_dwords);
+ }
+
+ static void arm_smmu_cmdq_issue_cmd(struct arm_smmu_device *smmu,
--- /dev/null
+From 3ec60043f7c02e1f79e4a90045ff2d2e80042941 Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Tue, 9 Aug 2016 16:23:17 +0100
+Subject: iommu/dma: Don't put uninitialised IOVA domains
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+commit 3ec60043f7c02e1f79e4a90045ff2d2e80042941 upstream.
+
+Due to the limitations of having to wait until we see a device's DMA
+restrictions before we know how we want an IOVA domain initialised,
+there is a window for error if a DMA ops domain is allocated but later
+freed without ever being used. In that case, init_iova_domain() was
+never called, so calling put_iova_domain() from iommu_put_dma_cookie()
+ends up trying to take an uninitialised lock and crashing.
+
+Make things robust by skipping the call unless the IOVA domain actually
+has been initialised, as we probably should have done from the start.
+
+Fixes: 0db2e5d18f76 ("iommu: Implement common IOMMU ops for DMA mapping")
+Reported-by: Nate Watterson <nwatters@codeaurora.org>
+Reviewed-by: Nate Watterson <nwatters@codeaurora.org>
+Tested-by: Nate Watterson <nwatters@codeaurora.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/dma-iommu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -68,7 +68,8 @@ void iommu_put_dma_cookie(struct iommu_d
+ if (!iovad)
+ return;
+
+- put_iova_domain(iovad);
++ if (iovad->granule)
++ put_iova_domain(iovad);
+ kfree(iovad);
+ domain->iova_cookie = NULL;
+ }
--- /dev/null
+From e633fc7a1347528c3b4a6bbdeb41f5d63988242c Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Thu, 11 Aug 2016 17:44:05 +0100
+Subject: iommu/io-pgtable-arm-v7s: Fix attributes when splitting blocks
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+commit e633fc7a1347528c3b4a6bbdeb41f5d63988242c upstream.
+
+Due to the attribute bits being all over the place in the different
+types of short-descriptor PTEs, when remapping an existing entry, e.g.
+splitting a section into pages, we take the approach of decomposing
+the PTE attributes back to the IOMMU API flags to start from scratch.
+
+On inspection, though, the existing code seems to have got the read-only
+bit backwards and ignored the XN bit. How embarrassing...
+
+Fortunately the primary user so far, the Mediatek IOMMU, both never
+splits blocks (because it only serves non-overlapping DMA API calls) and
+also ignores permissions anyway, but let's put things right before any
+future users trip up.
+
+Fixes: e5fc9753b1a8 ("iommu/io-pgtable: Add ARMv7 short descriptor support")
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/io-pgtable-arm-v7s.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/io-pgtable-arm-v7s.c
++++ b/drivers/iommu/io-pgtable-arm-v7s.c
+@@ -286,12 +286,14 @@ static int arm_v7s_pte_to_prot(arm_v7s_i
+ int prot = IOMMU_READ;
+ arm_v7s_iopte attr = pte >> ARM_V7S_ATTR_SHIFT(lvl);
+
+- if (attr & ARM_V7S_PTE_AP_RDONLY)
++ if (!(attr & ARM_V7S_PTE_AP_RDONLY))
+ prot |= IOMMU_WRITE;
+ if ((attr & (ARM_V7S_TEX_MASK << ARM_V7S_TEX_SHIFT)) == 0)
+ prot |= IOMMU_MMIO;
+ else if (pte & ARM_V7S_ATTR_C)
+ prot |= IOMMU_CACHE;
++ if (pte & ARM_V7S_ATTR_XN(lvl))
++ prot |= IOMMU_NOEXEC;
+
+ return prot;
+ }
--- /dev/null
+From 6b07d9ca9b5363dda959b9582a3fc9c0b89ef3b5 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 2 Aug 2016 11:13:41 +0200
+Subject: mac80211: fix purging multicast PS buffer queue
+
+From: Felix Fietkau <nbd@nbd.name>
+
+commit 6b07d9ca9b5363dda959b9582a3fc9c0b89ef3b5 upstream.
+
+The code currently assumes that buffered multicast PS frames don't have
+a pending ACK frame for tx status reporting.
+However, hostapd sends a broadcast deauth frame on teardown for which tx
+status is requested. This can lead to the "Have pending ack frames"
+warning on module reload.
+Fix this by using ieee80211_free_txskb/ieee80211_purge_tx_queue.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/cfg.c | 2 +-
+ net/mac80211/tx.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -869,7 +869,7 @@ static int ieee80211_stop_ap(struct wiph
+
+ /* free all potentially still buffered bcast frames */
+ local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
+- skb_queue_purge(&sdata->u.ap.ps.bc_buf);
++ ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf);
+
+ mutex_lock(&local->mtx);
+ ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -365,7 +365,7 @@ static void purge_old_ps_buffers(struct
+ skb = skb_dequeue(&ps->bc_buf);
+ if (skb) {
+ purged++;
+- dev_kfree_skb(skb);
++ ieee80211_free_txskb(&local->hw, skb);
+ }
+ total += skb_queue_len(&ps->bc_buf);
+ }
+@@ -448,7 +448,7 @@ ieee80211_tx_h_multicast_ps_buf(struct i
+ if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
+ ps_dbg(tx->sdata,
+ "BC TX buffer full - dropping the oldest frame\n");
+- dev_kfree_skb(skb_dequeue(&ps->bc_buf));
++ ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
+ } else
+ tx->local->total_ps_buffered++;
+
+@@ -4055,7 +4055,7 @@ ieee80211_get_buffered_bc(struct ieee802
+ sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
+ if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
+ break;
+- dev_kfree_skb_any(skb);
++ ieee80211_free_txskb(hw, skb);
+ }
+
+ info = IEEE80211_SKB_CB(skb);
--- /dev/null
+From e7f851684efb3377e9c93aca7fae6e76212e5680 Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Fri, 5 Aug 2016 23:37:34 -0700
+Subject: megaraid_sas: Fix probing cards without io port
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit e7f851684efb3377e9c93aca7fae6e76212e5680 upstream.
+
+Found one megaraid_sas HBA probe fails,
+
+[ 187.235190] scsi host2: Avago SAS based MegaRAID driver
+[ 191.112365] megaraid_sas 0000:89:00.0: BAR 0: can't reserve [io 0x0000-0x00ff]
+[ 191.120548] megaraid_sas 0000:89:00.0: IO memory region busy!
+
+and the card has resource like,
+[ 125.097714] pci 0000:89:00.0: [1000:005d] type 00 class 0x010400
+[ 125.104446] pci 0000:89:00.0: reg 0x10: [io 0x0000-0x00ff]
+[ 125.110686] pci 0000:89:00.0: reg 0x14: [mem 0xce400000-0xce40ffff 64bit]
+[ 125.118286] pci 0000:89:00.0: reg 0x1c: [mem 0xce300000-0xce3fffff 64bit]
+[ 125.125891] pci 0000:89:00.0: reg 0x30: [mem 0xce200000-0xce2fffff pref]
+
+that does not io port resource allocated from BIOS, and kernel can not
+assign one as io port shortage.
+
+The driver is only looking for MEM, and should not fail.
+
+It turns out megasas_init_fw() etc are using bar index as mask. index 1
+is used as mask 1, so that pci_request_selected_regions() is trying to
+request BAR0 instead of BAR1.
+
+Fix all related reference.
+
+Fixes: b6d5d8808b4c ("megaraid_sas: Use lowest memory bar for SR-IOV VF support")
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Acked-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 6 +++---
+ drivers/scsi/megaraid/megaraid_sas_fusion.c | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasa
+ /* Find first memory bar */
+ bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
+ instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
+- if (pci_request_selected_regions(instance->pdev, instance->bar,
++ if (pci_request_selected_regions(instance->pdev, 1<<instance->bar,
+ "megasas: LSI")) {
+ dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n");
+ return -EBUSY;
+@@ -5339,7 +5339,7 @@ fail_ready_state:
+ iounmap(instance->reg_set);
+
+ fail_ioremap:
+- pci_release_selected_regions(instance->pdev, instance->bar);
++ pci_release_selected_regions(instance->pdev, 1<<instance->bar);
+
+ return -EINVAL;
+ }
+@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct m
+
+ iounmap(instance->reg_set);
+
+- pci_release_selected_regions(instance->pdev, instance->bar);
++ pci_release_selected_regions(instance->pdev, 1<<instance->bar);
+ }
+
+ /**
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_in
+
+ iounmap(instance->reg_set);
+
+- pci_release_selected_regions(instance->pdev, instance->bar);
++ pci_release_selected_regions(instance->pdev, 1<<instance->bar);
+ }
+
+ /**
--- /dev/null
+From 9798ac6d32c1a32d6d92d853ff507d2d39c4300c Mon Sep 17 00:00:00 2001
+From: Tomeu Vizoso <tomeu.vizoso@collabora.com>
+Date: Fri, 15 Jul 2016 16:28:41 -0700
+Subject: mfd: cros_ec: Add cros_ec_cmd_xfer_status() helper
+
+From: Tomeu Vizoso <tomeu.vizoso@collabora.com>
+
+commit 9798ac6d32c1a32d6d92d853ff507d2d39c4300c upstream.
+
+So that callers of cros_ec_cmd_xfer() don't have to repeat boilerplate
+code when checking for errors from the EC side.
+
+Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
+Reviewed-by: Benson Leung <bleung@chromium.org>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Acked-by: Lee Jones <lee.jones@linaro.org>
+Tested-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/chrome/cros_ec_proto.c | 17 +++++++++++++++++
+ include/linux/mfd/cros_ec.h | 15 +++++++++++++++
+ 2 files changed, 32 insertions(+)
+
+--- a/drivers/platform/chrome/cros_ec_proto.c
++++ b/drivers/platform/chrome/cros_ec_proto.c
+@@ -380,3 +380,20 @@ int cros_ec_cmd_xfer(struct cros_ec_devi
+ return ret;
+ }
+ EXPORT_SYMBOL(cros_ec_cmd_xfer);
++
++int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev,
++ struct cros_ec_command *msg)
++{
++ int ret;
++
++ ret = cros_ec_cmd_xfer(ec_dev, msg);
++ if (ret < 0) {
++ dev_err(ec_dev->dev, "Command xfer error (err:%d)\n", ret);
++ } else if (msg->result != EC_RES_SUCCESS) {
++ dev_dbg(ec_dev->dev, "Command result (err: %d)\n", msg->result);
++ return -EPROTO;
++ }
++
++ return ret;
++}
++EXPORT_SYMBOL(cros_ec_cmd_xfer_status);
+--- a/include/linux/mfd/cros_ec.h
++++ b/include/linux/mfd/cros_ec.h
+@@ -226,6 +226,21 @@ int cros_ec_cmd_xfer(struct cros_ec_devi
+ struct cros_ec_command *msg);
+
+ /**
++ * cros_ec_cmd_xfer_status - Send a command to the ChromeOS EC
++ *
++ * This function is identical to cros_ec_cmd_xfer, except it returns success
++ * status only if both the command was transmitted successfully and the EC
++ * replied with success status. It's not necessary to check msg->result when
++ * using this function.
++ *
++ * @ec_dev: EC device
++ * @msg: Message to write
++ * @return: Num. of bytes transferred on success, <0 on failure
++ */
++int cros_ec_cmd_xfer_status(struct cros_ec_device *ec_dev,
++ struct cros_ec_command *msg);
++
++/**
+ * cros_ec_remove - Remove a ChromeOS EC
+ *
+ * Call this to deregister a ChromeOS EC, then clean up any private data.
--- /dev/null
+From 11bd969fdefea3ac0cb9791224f1e09784e21e58 Mon Sep 17 00:00:00 2001
+From: Ross Zwisler <ross.zwisler@linux.intel.com>
+Date: Thu, 25 Aug 2016 15:17:17 -0700
+Subject: mm: silently skip readahead for DAX inodes
+
+From: Ross Zwisler <ross.zwisler@linux.intel.com>
+
+commit 11bd969fdefea3ac0cb9791224f1e09784e21e58 upstream.
+
+For DAX inodes we need to be careful to never have page cache pages in
+the mapping->page_tree. This radix tree should be composed only of DAX
+exceptional entries and zero pages.
+
+ltp's readahead02 test was triggering a warning because we were trying
+to insert a DAX exceptional entry but found that a page cache page had
+already been inserted into the tree. This page was being inserted into
+the radix tree in response to a readahead(2) call.
+
+Readahead doesn't make sense for DAX inodes, but we don't want it to
+report a failure either. Instead, we just return success and don't do
+any work.
+
+Link: http://lkml.kernel.org/r/20160824221429.21158-1-ross.zwisler@linux.intel.com
+Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com>
+Reported-by: Jeff Moyer <jmoyer@redhat.com>
+Cc: Dan Williams <dan.j.williams@intel.com>
+Cc: Dave Chinner <david@fromorbit.com>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Jan Kara <jack@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/readahead.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/mm/readahead.c
++++ b/mm/readahead.c
+@@ -8,6 +8,7 @@
+ */
+
+ #include <linux/kernel.h>
++#include <linux/dax.h>
+ #include <linux/gfp.h>
+ #include <linux/export.h>
+ #include <linux/blkdev.h>
+@@ -545,6 +546,14 @@ do_readahead(struct address_space *mappi
+ if (!mapping || !mapping->a_ops)
+ return -EINVAL;
+
++ /*
++ * Readahead doesn't make sense for DAX inodes, but we don't want it
++ * to report a failure either. Instead, we just return success and
++ * don't do any work.
++ */
++ if (dax_mapping(mapping))
++ return 0;
++
+ return force_page_cache_readahead(mapping, filp, index, nr);
+ }
+
--- /dev/null
+From ce7c6c9e1d997a2670aead3a7b87f4df32c11118 Mon Sep 17 00:00:00 2001
+From: Greg Edwards <gedwards@fireweed.org>
+Date: Sat, 30 Jul 2016 10:06:26 -0600
+Subject: mpt3sas: Fix resume on WarpDrive flash cards
+
+From: Greg Edwards <gedwards@fireweed.org>
+
+commit ce7c6c9e1d997a2670aead3a7b87f4df32c11118 upstream.
+
+mpt3sas crashes on resume after suspend with WarpDrive flash cards. The
+reply_post_host_index array is not set back up after the resume, and we
+deference a stale pointer in _base_interrupt().
+
+[ 47.309711] BUG: unable to handle kernel paging request at ffffc90001f8006c
+[ 47.318289] IP: [<ffffffffc00863ef>] _base_interrupt+0x49f/0xa30 [mpt3sas]
+[ 47.326749] PGD 41ccaa067 PUD 41ccab067 PMD 3466c067 PTE 0
+[ 47.333848] Oops: 0002 [#1] SMP
+...
+[ 47.452708] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.7.0 #6
+[ 47.460506] Hardware name: Dell Inc. OptiPlex 990/06D7TR, BIOS A18 09/24/2013
+[ 47.469629] task: ffffffff81c0d500 ti: ffffffff81c00000 task.ti: ffffffff81c00000
+[ 47.479112] RIP: 0010:[<ffffffffc00863ef>] [<ffffffffc00863ef>] _base_interrupt+0x49f/0xa30 [mpt3sas]
+[ 47.490466] RSP: 0018:ffff88041d203e30 EFLAGS: 00010002
+[ 47.497801] RAX: 0000000000000001 RBX: ffff880033f4c000 RCX: 0000000000000001
+[ 47.506973] RDX: ffffc90001f8006c RSI: 0000000000000082 RDI: 0000000000000082
+[ 47.516141] RBP: ffff88041d203eb0 R08: ffff8804118e2820 R09: 0000000000000001
+[ 47.525300] R10: 0000000000000001 R11: 00000000100c0000 R12: 0000000000000000
+[ 47.534457] R13: ffff880412c487e0 R14: ffff88041a8987d8 R15: 0000000000000001
+[ 47.543632] FS: 0000000000000000(0000) GS:ffff88041d200000(0000) knlGS:0000000000000000
+[ 47.553796] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 47.561632] CR2: ffffc90001f8006c CR3: 0000000001c06000 CR4: 00000000000406f0
+[ 47.570883] Stack:
+[ 47.575015] 000000001d211228 ffff88041d2100c0 ffff8800c47d8130 0000000000000100
+[ 47.584625] ffff8804100c0000 100c000000000000 ffff88041a8992a0 ffff88041a8987f8
+[ 47.594230] ffff88041d203e00 ffffffff81111e55 000000000000038c ffff880414ad4280
+[ 47.603862] Call Trace:
+[ 47.608474] <IRQ>
+[ 47.610413] [<ffffffff81111e55>] ? call_timer_fn+0x35/0x120
+[ 47.620539] [<ffffffff81100a1f>] handle_irq_event_percpu+0x7f/0x1c0
+[ 47.629061] [<ffffffff81100b8c>] handle_irq_event+0x2c/0x50
+[ 47.636859] [<ffffffff81103fff>] handle_edge_irq+0x6f/0x130
+[ 47.644654] [<ffffffff8102fbf3>] handle_irq+0x73/0x120
+[ 47.652011] [<ffffffff810c6ada>] ? atomic_notifier_call_chain+0x1a/0x20
+[ 47.660854] [<ffffffff817e374b>] do_IRQ+0x4b/0xd0
+[ 47.667777] [<ffffffff817e160c>] common_interrupt+0x8c/0x8c
+[ 47.675635] <EOI>
+
+Move the reply_post_host_index array setup into
+mpt3sas_base_map_resources(), which is also in the resume path.
+
+Signed-off-by: Greg Edwards <gedwards@fireweed.org>
+Acked-by: Chaitra P B <chaitra.basappa@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SA
+ } else
+ ioc->msix96_vector = 0;
+
++ if (ioc->is_warpdrive) {
++ ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
++ &ioc->chip->ReplyPostHostIndex;
++
++ for (i = 1; i < ioc->cpu_msix_table_sz; i++)
++ ioc->reply_post_host_index[i] =
++ (resource_size_t __iomem *)
++ ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
++ * 4)));
++ }
++
+ list_for_each_entry(reply_q, &ioc->reply_queue_list, list)
+ pr_info(MPT3SAS_FMT "%s: IRQ %d\n",
+ reply_q->name, ((ioc->msix_enable) ? "PCI-MSI-X enabled" :
+@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPT
+ if (r)
+ goto out_free_resources;
+
+- if (ioc->is_warpdrive) {
+- ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
+- &ioc->chip->ReplyPostHostIndex;
+-
+- for (i = 1; i < ioc->cpu_msix_table_sz; i++)
+- ioc->reply_post_host_index[i] =
+- (resource_size_t __iomem *)
+- ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
+- * 4)));
+- }
+-
+ pci_set_drvdata(ioc->pdev, ioc->shost);
+ r = _base_get_ioc_facts(ioc, CAN_SLEEP);
+ if (r)
--- /dev/null
+From 34276bb062b8449b3b0a208c9b848a1a27920075 Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Mon, 15 Aug 2016 14:58:43 +0200
+Subject: of: fix reference counting in of_graph_get_endpoint_by_regs
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+commit 34276bb062b8449b3b0a208c9b848a1a27920075 upstream.
+
+The called of_graph_get_next_endpoint() already decrements the refcount
+of the prev node, so it is wrong to do it again in the calling function.
+
+Use the for_each_endpoint_of_node() helper to interate through the
+endpoint OF nodes, which already does the right thing and simplifies
+the code a bit.
+
+Fixes: 8ccd0d0ca041
+(of: add helper for getting endpoint node of specific identifiers)
+Reported-by: David Jander <david@protonic.nl>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/base.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -2318,20 +2318,13 @@ struct device_node *of_graph_get_endpoin
+ const struct device_node *parent, int port_reg, int reg)
+ {
+ struct of_endpoint endpoint;
+- struct device_node *node, *prev_node = NULL;
+-
+- while (1) {
+- node = of_graph_get_next_endpoint(parent, prev_node);
+- of_node_put(prev_node);
+- if (!node)
+- break;
++ struct device_node *node = NULL;
+
++ for_each_endpoint_of_node(parent, node) {
+ of_graph_parse_endpoint(node, &endpoint);
+ if (((port_reg == -1) || (endpoint.port == port_reg)) &&
+ ((reg == -1) || (endpoint.id == reg)))
+ return node;
+-
+- prev_node = node;
+ }
+
+ return NULL;
--- /dev/null
+From cca2094605efe6ccf43ff2876dd5bccc799202d8 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Tue, 16 Aug 2016 13:33:26 +0200
+Subject: perf/core: Fix event_function_local()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit cca2094605efe6ccf43ff2876dd5bccc799202d8 upstream.
+
+Vincent reported triggering the WARN_ON_ONCE() in event_function_local().
+
+While thinking through cases I noticed that by using event_function()
+directly, we miss the inactive case usually handled by
+event_function_call().
+
+Therefore construct a blend of event_function_call() and
+event_function() that handles the cases relevant to
+event_function_local().
+
+Reported-by: Vince Weaver <vincent.weaver@maine.edu>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: fae3fde65138 ("perf: Collapse and fix event_function_call() users")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/core.c | 60 ++++++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 48 insertions(+), 12 deletions(-)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -242,18 +242,6 @@ unlock:
+ return ret;
+ }
+
+-static void event_function_local(struct perf_event *event, event_f func, void *data)
+-{
+- struct event_function_struct efs = {
+- .event = event,
+- .func = func,
+- .data = data,
+- };
+-
+- int ret = event_function(&efs);
+- WARN_ON_ONCE(ret);
+-}
+-
+ static void event_function_call(struct perf_event *event, event_f func, void *data)
+ {
+ struct perf_event_context *ctx = event->ctx;
+@@ -303,6 +291,54 @@ again:
+ raw_spin_unlock_irq(&ctx->lock);
+ }
+
++/*
++ * Similar to event_function_call() + event_function(), but hard assumes IRQs
++ * are already disabled and we're on the right CPU.
++ */
++static void event_function_local(struct perf_event *event, event_f func, void *data)
++{
++ struct perf_event_context *ctx = event->ctx;
++ struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
++ struct task_struct *task = READ_ONCE(ctx->task);
++ struct perf_event_context *task_ctx = NULL;
++
++ WARN_ON_ONCE(!irqs_disabled());
++
++ if (task) {
++ if (task == TASK_TOMBSTONE)
++ return;
++
++ task_ctx = ctx;
++ }
++
++ perf_ctx_lock(cpuctx, task_ctx);
++
++ task = ctx->task;
++ if (task == TASK_TOMBSTONE)
++ goto unlock;
++
++ if (task) {
++ /*
++ * We must be either inactive or active and the right task,
++ * otherwise we're screwed, since we cannot IPI to somewhere
++ * else.
++ */
++ if (ctx->is_active) {
++ if (WARN_ON_ONCE(task != current))
++ goto unlock;
++
++ if (WARN_ON_ONCE(cpuctx->task_ctx != ctx))
++ goto unlock;
++ }
++ } else {
++ WARN_ON_ONCE(&cpuctx->ctx != ctx);
++ }
++
++ func(event, cpuctx, ctx, data);
++unlock:
++ perf_ctx_unlock(cpuctx, task_ctx);
++}
++
+ #define PERF_FLAG_ALL (PERF_FLAG_FD_NO_GROUP |\
+ PERF_FLAG_FD_OUTPUT |\
+ PERF_FLAG_PID_CGROUP |\
--- /dev/null
+From 50de1a0c54cdbc69a6dbcbc323f53daf95a4050e Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Sat, 13 Aug 2016 11:55:33 +1000
+Subject: perf symbols: Fix annotation of objects with debuginfo files
+
+From: Anton Blanchard <anton@samba.org>
+
+commit 50de1a0c54cdbc69a6dbcbc323f53daf95a4050e upstream.
+
+Commit 73cdf0c6ea9c ("perf symbols: Record text offset in dso
+to calculate objdump address") started storing the offset of
+the text section for all DSOs:
+
+ if (elf_section_by_name(elf, &ehdr, &tshdr, ".text", NULL))
+ dso->text_offset = tshdr.sh_addr - tshdr.sh_offset;
+
+Unfortunately this breaks debuginfo files, because we need to calculate
+the offset of the text section in the associated executable file. As a
+result perf annotate returns junk for all debuginfo files.
+
+Fix this by using runtime_ss->elf which should point at the executable
+when parsing a debuginfo file.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Reviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Tested-by: Wang Nan <wangnan0@huawei.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
+Fixes: 73cdf0c6ea9c ("perf symbols: Record text offset in dso to calculate objdump address")
+Link: http://lkml.kernel.org/r/20160813115533.6de17912@kryten
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/symbol-elf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -827,7 +827,8 @@ int dso__load_sym(struct dso *dso, struc
+ sec = syms_ss->symtab;
+ shdr = syms_ss->symshdr;
+
+- if (elf_section_by_name(elf, &ehdr, &tshdr, ".text", NULL))
++ if (elf_section_by_name(runtime_ss->elf, &runtime_ss->ehdr, &tshdr,
++ ".text", NULL))
+ dso->text_offset = tshdr.sh_addr - tshdr.sh_offset;
+
+ if (runtime_ss->opdsec)
--- /dev/null
+From 33da54fa86e29b87fe1e83bd0f15b4ef2be53ecb Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Thu, 11 Aug 2016 10:50:57 +0200
+Subject: perf tools mem: Fix -t store option for record command
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+commit 33da54fa86e29b87fe1e83bd0f15b4ef2be53ecb upstream.
+
+Michael reported 'perf mem -t store record' being broken. The reason is
+latest rework of this area:
+
+ commit acbe613e0c03 ("perf tools: Add monitored events array")
+
+We don't mark perf_mem_events store record when -t store option is
+specified.
+
+Committer notes:
+
+Before:
+
+ # perf mem -t store record usleep 1
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.020 MB perf.data (7 samples) ]
+ # perf evlist
+ cycles:ppp
+ #
+
+After:
+
+ # perf mem -t store record usleep 1
+ [ perf record: Woken up 1 times to write data ]
+ [ perf record: Captured and wrote 0.020 MB perf.data (7 samples) ]
+ # perf evlist
+ cpu/mem-stores/P
+ #
+
+Reported-by: Michael Petlan <mpetlan@redhat.com>
+Signed-off-by: Jiri Olsa <jolsa@redhat.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Fixes: acbe613e0c03 ("perf tools: Add monitored events array")
+Link: http://lkml.kernel.org/r/1470905457-18311-1-git-send-email-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/builtin-mem.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/tools/perf/builtin-mem.c
++++ b/tools/perf/builtin-mem.c
+@@ -87,6 +87,9 @@ static int __cmd_record(int argc, const
+ if (mem->operation & MEM_OPERATION_LOAD)
+ perf_mem_events[PERF_MEM_EVENTS__LOAD].record = true;
+
++ if (mem->operation & MEM_OPERATION_STORE)
++ perf_mem_events[PERF_MEM_EVENTS__STORE].record = true;
++
+ if (perf_mem_events[PERF_MEM_EVENTS__LOAD].record)
+ rec_argv[i++] = "-W";
+
--- /dev/null
+From 8cf4345575a416e6856a6856ac6eaa31ad883126 Mon Sep 17 00:00:00 2001
+From: "Agrawal, Nitesh-kumar" <Nitesh-kumar.Agrawal@amd.com>
+Date: Tue, 26 Jul 2016 08:28:19 +0000
+Subject: pinctrl/amd: Remove the default de-bounce time
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Agrawal, Nitesh-kumar <Nitesh-kumar.Agrawal@amd.com>
+
+commit 8cf4345575a416e6856a6856ac6eaa31ad883126 upstream.
+
+In the function amd_gpio_irq_enable() and
+amd_gpio_direction_input(), remove the code which is setting
+the default de-bounce time to 2.75ms.
+
+The driver code shall use the same settings as specified in
+BIOS. Any default assignment impacts TouchPad behaviour when
+the LevelTrig is set to EDGE FALLING.
+
+Reviewed-by: Ken Xue <Ken.Xue@amd.com>
+Signed-off-by: Nitesh Kumar Agrawal <Nitesh-kumar.Agrawal@amd.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/pinctrl-amd.c | 20 --------------------
+ 1 file changed, 20 deletions(-)
+
+--- a/drivers/pinctrl/pinctrl-amd.c
++++ b/drivers/pinctrl/pinctrl-amd.c
+@@ -43,17 +43,6 @@ static int amd_gpio_direction_input(stru
+
+ spin_lock_irqsave(&gpio_dev->lock, flags);
+ pin_reg = readl(gpio_dev->base + offset * 4);
+- /*
+- * Suppose BIOS or Bootloader sets specific debounce for the
+- * GPIO. if not, set debounce to be 2.75ms and remove glitch.
+- */
+- if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
+- pin_reg |= 0xf;
+- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
+- pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
+- pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
+- }
+-
+ pin_reg &= ~BIT(OUTPUT_ENABLE_OFF);
+ writel(pin_reg, gpio_dev->base + offset * 4);
+ spin_unlock_irqrestore(&gpio_dev->lock, flags);
+@@ -326,15 +315,6 @@ static void amd_gpio_irq_enable(struct i
+
+ spin_lock_irqsave(&gpio_dev->lock, flags);
+ pin_reg = readl(gpio_dev->base + (d->hwirq)*4);
+- /*
+- Suppose BIOS or Bootloader sets specific debounce for the
+- GPIO. if not, set debounce to be 2.75ms.
+- */
+- if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
+- pin_reg |= 0xf;
+- pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
+- pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
+- }
+ pin_reg |= BIT(INTERRUPT_ENABLE_OFF);
+ pin_reg |= BIT(INTERRUPT_MASK_OFF);
+ writel(pin_reg, gpio_dev->base + (d->hwirq)*4);
--- /dev/null
+From 5b236d0fde21d88351420ef0b9a6cb7aeeea0c54 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyj.lk@gmail.com>
+Date: Tue, 26 Jul 2016 14:51:58 +0000
+Subject: pinctrl: meson: Drop pinctrl_unregister for devm_ registered device
+
+From: Wei Yongjun <weiyj.lk@gmail.com>
+
+commit 5b236d0fde21d88351420ef0b9a6cb7aeeea0c54 upstream.
+
+It's not necessary to unregister pin controller device registered
+with devm_pinctrl_register() and using pinctrl_unregister() leads
+to a double free.
+
+This is detected by Coccinelle semantic patch.
+
+Fixes: e649f7ec8c5f ("pinctrl: meson: Use devm_pinctrl_register() for pinctrl registration")
+Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
+Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/meson/pinctrl-meson.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/pinctrl/meson/pinctrl-meson.c
++++ b/drivers/pinctrl/meson/pinctrl-meson.c
+@@ -727,13 +727,7 @@ static int meson_pinctrl_probe(struct pl
+ return PTR_ERR(pc->pcdev);
+ }
+
+- ret = meson_gpiolib_register(pc);
+- if (ret) {
+- pinctrl_unregister(pc->pcdev);
+- return ret;
+- }
+-
+- return 0;
++ return meson_gpiolib_register(pc);
+ }
+
+ static struct platform_driver meson_pinctrl_driver = {
--- /dev/null
+From 9ba333dc55cbb9523553df973adb3024d223e905 Mon Sep 17 00:00:00 2001
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+Date: Mon, 8 Aug 2016 14:08:17 +0200
+Subject: s390/dasd: fix hanging device after clear subchannel
+
+From: Stefan Haberland <sth@linux.vnet.ibm.com>
+
+commit 9ba333dc55cbb9523553df973adb3024d223e905 upstream.
+
+When a device is in a status where CIO has killed all I/O by itself the
+interrupt for a clear request may not contain an irb to determine the
+clear function. Instead it contains an error pointer -EIO.
+This was ignored by the DASD int_handler leading to a hanging device
+waiting for a clear interrupt.
+
+Handle -EIO error pointer correctly for requests that are clear pending and
+treat the clear as successful.
+
+Signed-off-by: Stefan Haberland <sth@linux.vnet.ibm.com>
+Reviewed-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/block/dasd.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -1643,9 +1643,18 @@ void dasd_int_handler(struct ccw_device
+ u8 *sense = NULL;
+ int expires;
+
++ cqr = (struct dasd_ccw_req *) intparm;
+ if (IS_ERR(irb)) {
+ switch (PTR_ERR(irb)) {
+ case -EIO:
++ if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) {
++ device = (struct dasd_device *) cqr->startdev;
++ cqr->status = DASD_CQR_CLEARED;
++ dasd_device_clear_timer(device);
++ wake_up(&dasd_flush_wq);
++ dasd_schedule_device_bh(device);
++ return;
++ }
+ break;
+ case -ETIMEDOUT:
+ DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
+@@ -1661,7 +1670,6 @@ void dasd_int_handler(struct ccw_device
+ }
+
+ now = get_tod_clock();
+- cqr = (struct dasd_ccw_req *) intparm;
+ /* check for conditions that should be handled immediately */
+ if (!cqr ||
+ !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) &&
--- /dev/null
+From 173be9a14f7b2e901cf77c18b1aafd4d672e9d9e Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Mon, 15 Aug 2016 18:38:42 +0200
+Subject: sched/cputime: Fix NO_HZ_FULL getrusage() monotonicity regression
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 173be9a14f7b2e901cf77c18b1aafd4d672e9d9e upstream.
+
+Mike reports:
+
+ Roughly 10% of the time, ltp testcase getrusage04 fails:
+ getrusage04 0 TINFO : Expected timers granularity is 4000 us
+ getrusage04 0 TINFO : Using 1 as multiply factor for max [us]time increment (1000+4000us)!
+ getrusage04 0 TINFO : utime: 0us; stime: 179us
+ getrusage04 0 TINFO : utime: 3751us; stime: 0us
+ getrusage04 1 TFAIL : getrusage04.c:133: stime increased > 5000us:
+
+And tracked it down to the case where the task simply doesn't get
+_any_ [us]time ticks.
+
+Update the code to assume all rtime is utime when we lack information,
+thus ensuring a task that elides the tick gets time accounted.
+
+Reported-by: Mike Galbraith <umgwanakikbuti@gmail.com>
+Tested-by: Mike Galbraith <umgwanakikbuti@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Fredrik Markstrom <fredrik.markstrom@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Radim <rkrcmar@redhat.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: Wanpeng Li <wanpeng.li@hotmail.com>
+Fixes: 9d7fb0427648 ("sched/cputime: Guarantee stime + utime == rtime")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sched/cputime.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+--- a/kernel/sched/cputime.c
++++ b/kernel/sched/cputime.c
+@@ -603,19 +603,25 @@ static void cputime_adjust(struct task_c
+ stime = curr->stime;
+ utime = curr->utime;
+
+- if (utime == 0) {
+- stime = rtime;
++ /*
++ * If either stime or both stime and utime are 0, assume all runtime is
++ * userspace. Once a task gets some ticks, the monotonicy code at
++ * 'update' will ensure things converge to the observed ratio.
++ */
++ if (stime == 0) {
++ utime = rtime;
+ goto update;
+ }
+
+- if (stime == 0) {
+- utime = rtime;
++ if (utime == 0) {
++ stime = rtime;
+ goto update;
+ }
+
+ stime = scale_stime((__force u64)stime, (__force u64)rtime,
+ (__force u64)(stime + utime));
+
++update:
+ /*
+ * Make sure stime doesn't go backwards; this preserves monotonicity
+ * for utime because rtime is monotonic.
+@@ -638,7 +644,6 @@ static void cputime_adjust(struct task_c
+ stime = rtime - utime;
+ }
+
+-update:
+ prev->stime = stime;
+ prev->utime = utime;
+ out:
usb-serial-ftdi_sio-add-device-id-for-wiced-usb-uart-dev-board.patch
usb-serial-ftdi_sio-add-pids-for-ivium-technologies-devices.patch
uprobes-fix-the-memcg-accounting.patch
+perf-symbols-fix-annotation-of-objects-with-debuginfo-files.patch
+perf-core-fix-event_function_local.patch
+perf-tools-mem-fix-t-store-option-for-record-command.patch
+iommu-dma-don-t-put-uninitialised-iova-domains.patch
+iommu-io-pgtable-arm-v7s-fix-attributes-when-splitting-blocks.patch
+iommu-arm-smmu-fix-cmdq-error-handling.patch
+iommu-arm-smmu-disable-stalling-faults-for-all-endpoints.patch
+iommu-arm-smmu-don-t-bug-if-we-find-aborting-stes-with-disable_bypass.patch
+pinctrl-meson-drop-pinctrl_unregister-for-devm_-registered-device.patch
+pinctrl-amd-remove-the-default-de-bounce-time.patch
+i2c-mux-demux-pinctrl-properly-roll-back-when-adding-adapter-fails.patch
+edac-sb_edac-fix-channel-reporting-on-knights-landing.patch
+s390-dasd-fix-hanging-device-after-clear-subchannel.patch
+mac80211-fix-purging-multicast-ps-buffer-queue.patch
+arm64-kernel-avoid-literal-load-of-virtual-address-with-mmu-off.patch
+arm64-avoid-tlb-conflict-with-config_randomize_base.patch
+arm64-dts-rockchip-add-reset-saradc-node-for-rk3368-socs.patch
+arm64-kernel-fix-unmasked-debug-exceptions-when-restoring-mdscr_el1.patch
+of-fix-reference-counting-in-of_graph_get_endpoint_by_regs.patch
+sched-cputime-fix-no_hz_full-getrusage-monotonicity-regression.patch
+iio-fix-sched-warning-do-not-call-blocking-ops-when-task_running.patch
+drm-amdgpu-change-gart-offset-to-64-bit.patch
+drm-amdgpu-fix-amdgpu_move_blit-on-32bit-systems.patch
+drm-amdgpu-fix-lru-size-grouping-v2.patch
+drm-amdgpu-avoid-a-possible-array-overflow.patch
+drm-amdgpu-skip-tv-cv-in-display-parsing.patch
+drm-amd-amdgpu-sdma-resume-fail-during-s4-on-ci.patch
+drm-amd-amdgpu-compute-ring-test-fail-during-s4-on-ci.patch
+drm-amdgpu-record-error-code-when-ring-test-failed.patch
+drm-i915-fix-iboost-setting-for-ddi-with-4-lanes-on-skl.patch
+drm-i915-program-iboost-settings-for-hdmi-dvi-on-skl.patch
+drm-i915-fix-iboost-setting-for-skl-y-u-dp-ddi-buffer-translation-entry-2.patch
+drm-i915-acquire-audio-powerwell-for-hd-audio-registers.patch
+drm-i915-fix-aliasing_ppgtt-leak.patch
+drm-i915-vlv-make-intel_crt_reset-per-encoder.patch
+drm-i915-vlv-reset-the-adpa-in-vlv_display_power_well_init.patch
+drm-i915-vlv-disable-hpd-in-valleyview_crt_detect_hotplug.patch
+drm-i915-enable-polling-when-we-don-t-have-hpd.patch
+arc-use-correct-offset-in-pt_regs-for-saving-restoring-user-mode-r25.patch
+arc-mm-fix-build-breakage-with-strict_mm_typechecks.patch
+arc-call-trace_hardirqs_on-before-enabling-irqs.patch
+arc-elide-redundant-setup-of-dma-callbacks.patch
+aacraid-check-size-values-after-double-fetch-from-user.patch
+mfd-cros_ec-add-cros_ec_cmd_xfer_status-helper.patch
+i2c-cros-ec-tunnel-fix-usage-of-cros_ec_cmd_xfer.patch
+cdc-acm-fix-wrong-pipe-type-on-rx-interrupt-xfers.patch
+mpt3sas-fix-resume-on-warpdrive-flash-cards.patch
+megaraid_sas-fix-probing-cards-without-io-port.patch
+usb-renesas_usbhs-gadget-fix-return-value-check-in-usbhs_mod_gadget_probe.patch
+dm-round-robin-do-not-use-this_cpu_ptr-without-having-preemption-disabled.patch
+gpio-fix-of-build-problem-on-um.patch
+gpio-max730x-set-gpiochip-data-pointer-before-using-it.patch
+fs-seq_file-fix-out-of-bounds-read.patch
+soft_dirty-fix-soft_dirty-during-thp-split.patch
+dax-fix-device-dax-region-base.patch
+mm-silently-skip-readahead-for-dax-inodes.patch
+btrfs-waiting-on-qgroup-rescan-should-not-always-be-interruptible.patch
+btrfs-properly-track-when-rescan-worker-is-running.patch
+btrfs-don-t-create-or-leak-aliased-root-while-cleaning-up-orphans.patch
--- /dev/null
+From 804dd150468cfd920d92d4b3cf00536fedef3902 Mon Sep 17 00:00:00 2001
+From: Andrea Arcangeli <aarcange@redhat.com>
+Date: Thu, 25 Aug 2016 15:16:57 -0700
+Subject: soft_dirty: fix soft_dirty during THP split
+
+From: Andrea Arcangeli <aarcange@redhat.com>
+
+commit 804dd150468cfd920d92d4b3cf00536fedef3902 upstream.
+
+While adding proper userfaultfd_wp support with bits in pagetable and
+swap entry to avoid false positives WP userfaults through swap/fork/
+KSM/etc, I've been adding a framework that mostly mirrors soft dirty.
+
+So I noticed in one place I had to add uffd_wp support to the pagetables
+that wasn't covered by soft_dirty and I think it should have.
+
+Example: in the THP migration code migrate_misplaced_transhuge_page()
+pmd_mkdirty is called unconditionally after mk_huge_pmd.
+
+ entry = mk_huge_pmd(new_page, vma->vm_page_prot);
+ entry = maybe_pmd_mkwrite(pmd_mkdirty(entry), vma);
+
+That sets soft dirty too (it's a false positive for soft dirty, the soft
+dirty bit could be more finegrained and transfer the bit like uffd_wp
+will do.. pmd/pte_uffd_wp() enforces the invariant that when it's set
+pmd/pte_write is not set).
+
+However in the THP split there's no unconditional pmd_mkdirty after
+mk_huge_pmd and pte_swp_mksoft_dirty isn't called after the migration
+entry is created. The code sets the dirty bit in the struct page
+instead of setting it in the pagetable (which is fully equivalent as far
+as the real dirty bit is concerned, as the whole point of pagetable bits
+is to be eventually flushed out of to the page, but that is not
+equivalent for the soft-dirty bit that gets lost in translation).
+
+This was found by code review only and totally untested as I'm working
+to actually replace soft dirty and I don't have time to test potential
+soft dirty bugfixes as well :).
+
+Transfer the soft_dirty from pmd to pte during THP splits.
+
+This fix avoids losing the soft_dirty bit and avoids userland memory
+corruption in the checkpoint.
+
+Fixes: eef1b3ba053aa6 ("thp: implement split_huge_pmd()")
+Link: http://lkml.kernel.org/r/1471610515-30229-2-git-send-email-aarcange@redhat.com
+Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
+Acked-by: Pavel Emelyanov <xemul@virtuozzo.com>
+Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/huge_memory.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -2872,7 +2872,7 @@ static void __split_huge_pmd_locked(stru
+ struct page *page;
+ pgtable_t pgtable;
+ pmd_t _pmd;
+- bool young, write, dirty;
++ bool young, write, dirty, soft_dirty;
+ unsigned long addr;
+ int i;
+
+@@ -2898,6 +2898,7 @@ static void __split_huge_pmd_locked(stru
+ write = pmd_write(*pmd);
+ young = pmd_young(*pmd);
+ dirty = pmd_dirty(*pmd);
++ soft_dirty = pmd_soft_dirty(*pmd);
+
+ pmdp_huge_split_prepare(vma, haddr, pmd);
+ pgtable = pgtable_trans_huge_withdraw(mm, pmd);
+@@ -2914,6 +2915,8 @@ static void __split_huge_pmd_locked(stru
+ swp_entry_t swp_entry;
+ swp_entry = make_migration_entry(page + i, write);
+ entry = swp_entry_to_pte(swp_entry);
++ if (soft_dirty)
++ entry = pte_swp_mksoft_dirty(entry);
+ } else {
+ entry = mk_pte(page + i, vma->vm_page_prot);
+ entry = maybe_mkwrite(entry, vma);
+@@ -2921,6 +2924,8 @@ static void __split_huge_pmd_locked(stru
+ entry = pte_wrprotect(entry);
+ if (!young)
+ entry = pte_mkold(entry);
++ if (soft_dirty)
++ entry = pte_mksoft_dirty(entry);
+ }
+ if (dirty)
+ SetPageDirty(page + i);
--- /dev/null
+From 3295235fd70ed6d594aadee8c892a14f6a4b2d2e Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyj.lk@gmail.com>
+Date: Sat, 13 Aug 2016 01:28:24 +0000
+Subject: usb: renesas_usbhs: gadget: fix return value check in usbhs_mod_gadget_probe()
+
+From: Wei Yongjun <weiyj.lk@gmail.com>
+
+commit 3295235fd70ed6d594aadee8c892a14f6a4b2d2e upstream.
+
+In case of error, the function usb_get_phy() returns ERR_PTR() and never
+returns NULL. The NULL test in the return value check should be replaced
+with IS_ERR().
+
+Fixes: b5a2875605ca ("usb: renesas_usbhs: Allow an OTG PHY driver to
+ provide VBUS")
+Acked-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/renesas_usbhs/mod_gadget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -1076,7 +1076,7 @@ int usbhs_mod_gadget_probe(struct usbhs_
+
+ gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED);
+ dev_info(dev, "%stransceiver found\n",
+- gpriv->transceiver ? "" : "no ");
++ !IS_ERR(gpriv->transceiver) ? "" : "no ");
+
+ /*
+ * CAUTION
projects / thirdparty / kernel / stable-queue.git / commitdiff
