--- /dev/null
+From ba6dea4f7cedb4b1c17e36f4087675d817c2e24b Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Mon, 26 Sep 2016 16:50:55 +0100
+Subject: ARM: 8616/1: dt: Respect property size when parsing CPUs
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+commit ba6dea4f7cedb4b1c17e36f4087675d817c2e24b upstream.
+
+Whilst MPIDR values themselves are less than 32 bits, it is still
+perfectly valid for a DT to have #address-cells > 1 in the CPUs node,
+resulting in the "reg" property having leading zero cell(s). In that
+situation, the big-endian nature of the data conspires with the current
+behaviour of only reading the first cell to cause the kernel to think
+all CPUs have ID 0, and become resoundingly unhappy as a consequence.
+
+Take the full property length into account when parsing CPUs so as to
+be correct under any circumstances.
+
+Cc: Russell King <linux@armlinux.org.uk>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/devtree.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/kernel/devtree.c
++++ b/arch/arm/kernel/devtree.c
+@@ -87,6 +87,8 @@ void __init arm_dt_init_cpu_maps(void)
+ return;
+
+ for_each_child_of_node(cpus, cpu) {
++ const __be32 *cell;
++ int prop_bytes;
+ u32 hwid;
+
+ if (of_node_cmp(cpu->type, "cpu"))
+@@ -98,7 +100,8 @@ void __init arm_dt_init_cpu_maps(void)
+ * properties is considered invalid to build the
+ * cpu_logical_map.
+ */
+- if (of_property_read_u32(cpu, "reg", &hwid)) {
++ cell = of_get_property(cpu, "reg", &prop_bytes);
++ if (!cell || prop_bytes < sizeof(*cell)) {
+ pr_debug(" * %s missing reg property\n",
+ cpu->full_name);
+ of_node_put(cpu);
+@@ -106,10 +109,15 @@ void __init arm_dt_init_cpu_maps(void)
+ }
+
+ /*
+- * 8 MSBs must be set to 0 in the DT since the reg property
++ * Bits n:24 must be set to 0 in the DT since the reg property
+ * defines the MPIDR[23:0].
+ */
+- if (hwid & ~MPIDR_HWID_BITMASK) {
++ do {
++ hwid = be32_to_cpu(*cell++);
++ prop_bytes -= sizeof(*cell);
++ } while (!hwid && prop_bytes > 0);
++
++ if (prop_bytes || (hwid & ~MPIDR_HWID_BITMASK)) {
+ of_node_put(cpu);
+ return;
+ }
--- /dev/null
+From d248220f0465b818887baa9829e691fe662b2c5e Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Thu, 29 Sep 2016 08:32:55 +0100
+Subject: ARM: 8617/1: dma: fix dma_max_pfn()
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit d248220f0465b818887baa9829e691fe662b2c5e upstream.
+
+Since commit 6ce0d2001692 ("ARM: dma: Use dma_pfn_offset for dma address translation"),
+dma_to_pfn() already returns the PFN with the physical memory start offset
+so we don't need to add it again.
+
+This fixes USB mass storage lock-up problem on systems that can't do DMA
+over the entire physical memory range (e.g.) Keystone 2 systems with 4GB RAM
+can only do DMA over the first 2GB. [K2E-EVM].
+
+What happens there is that without this patch SCSI layer sets a wrong
+bounce buffer limit in scsi_calculate_bounce_limit() for the USB mass
+storage device. dma_max_pfn() evaluates to 0x8fffff and bounce_limit
+is set to 0x8fffff000 whereas maximum DMA'ble physical memory on Keystone 2
+is 0x87fffffff. This results in non DMA'ble pages being given to the
+USB controller and hence the lock-up.
+
+NOTE: in the above case, USB-SCSI-device's dma_pfn_offset was showing as 0.
+This should have really been 0x780000 as on K2e, LOWMEM_START is 0x80000000
+and HIGHMEM_START is 0x800000000. DMA zone is 2GB so dma_max_pfn should be
+0x87ffff. The incorrect dma_pfn_offset for the USB storage device is because
+USB devices are not correctly inheriting the dma_pfn_offset from the
+USB host controller. This will be fixed by a separate patch.
+
+Fixes: 6ce0d2001692 ("ARM: dma: Use dma_pfn_offset for dma address translation")
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Olof Johansson <olof@lixom.net>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Reported-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/dma-mapping.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/include/asm/dma-mapping.h
++++ b/arch/arm/include/asm/dma-mapping.h
+@@ -112,7 +112,7 @@ static inline dma_addr_t virt_to_dma(str
+ /* The ARM override for dma_max_pfn() */
+ static inline unsigned long dma_max_pfn(struct device *dev)
+ {
+- return PHYS_PFN_OFFSET + dma_to_pfn(dev, *dev->dma_mask);
++ return dma_to_pfn(dev, *dev->dma_mask);
+ }
+ #define dma_max_pfn(dev) dma_max_pfn(dev)
+
--- /dev/null
+From 9abefcb1aaa58b9d5aa40a8bb12c87d02415e4c8 Mon Sep 17 00:00:00 2001
+From: Sergei Miroshnichenko <sergeimir@emcraft.com>
+Date: Wed, 7 Sep 2016 16:51:12 +0300
+Subject: can: dev: fix deadlock reported after bus-off
+
+From: Sergei Miroshnichenko <sergeimir@emcraft.com>
+
+commit 9abefcb1aaa58b9d5aa40a8bb12c87d02415e4c8 upstream.
+
+A timer was used to restart after the bus-off state, leading to a
+relatively large can_restart() executed in an interrupt context,
+which in turn sets up pinctrl. When this happens during system boot,
+there is a high probability of grabbing the pinctrl_list_mutex,
+which is locked already by the probe() of other device, making the
+kernel suspect a deadlock condition [1].
+
+To resolve this issue, the restart_timer is replaced by a delayed
+work.
+
+[1] https://github.com/victronenergy/venus/issues/24
+
+Signed-off-by: Sergei Miroshnichenko <sergeimir@emcraft.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/dev.c | 27 +++++++++++++++++----------
+ include/linux/can/dev.h | 3 ++-
+ 2 files changed, 19 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -21,6 +21,7 @@
+ #include <linux/slab.h>
+ #include <linux/netdevice.h>
+ #include <linux/if_arp.h>
++#include <linux/workqueue.h>
+ #include <linux/can.h>
+ #include <linux/can/dev.h>
+ #include <linux/can/skb.h>
+@@ -471,9 +472,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb);
+ /*
+ * CAN device restart for bus-off recovery
+ */
+-static void can_restart(unsigned long data)
++static void can_restart(struct net_device *dev)
+ {
+- struct net_device *dev = (struct net_device *)data;
+ struct can_priv *priv = netdev_priv(dev);
+ struct net_device_stats *stats = &dev->stats;
+ struct sk_buff *skb;
+@@ -513,6 +513,14 @@ restart:
+ netdev_err(dev, "Error %d during restart", err);
+ }
+
++static void can_restart_work(struct work_struct *work)
++{
++ struct delayed_work *dwork = to_delayed_work(work);
++ struct can_priv *priv = container_of(dwork, struct can_priv, restart_work);
++
++ can_restart(priv->dev);
++}
++
+ int can_restart_now(struct net_device *dev)
+ {
+ struct can_priv *priv = netdev_priv(dev);
+@@ -526,8 +534,8 @@ int can_restart_now(struct net_device *d
+ if (priv->state != CAN_STATE_BUS_OFF)
+ return -EBUSY;
+
+- /* Runs as soon as possible in the timer context */
+- mod_timer(&priv->restart_timer, jiffies);
++ cancel_delayed_work_sync(&priv->restart_work);
++ can_restart(dev);
+
+ return 0;
+ }
+@@ -548,8 +556,8 @@ void can_bus_off(struct net_device *dev)
+ netif_carrier_off(dev);
+
+ if (priv->restart_ms)
+- mod_timer(&priv->restart_timer,
+- jiffies + (priv->restart_ms * HZ) / 1000);
++ schedule_delayed_work(&priv->restart_work,
++ msecs_to_jiffies(priv->restart_ms));
+ }
+ EXPORT_SYMBOL_GPL(can_bus_off);
+
+@@ -658,6 +666,7 @@ struct net_device *alloc_candev(int size
+ return NULL;
+
+ priv = netdev_priv(dev);
++ priv->dev = dev;
+
+ if (echo_skb_max) {
+ priv->echo_skb_max = echo_skb_max;
+@@ -667,7 +676,7 @@ struct net_device *alloc_candev(int size
+
+ priv->state = CAN_STATE_STOPPED;
+
+- init_timer(&priv->restart_timer);
++ INIT_DELAYED_WORK(&priv->restart_work, can_restart_work);
+
+ return dev;
+ }
+@@ -748,8 +757,6 @@ int open_candev(struct net_device *dev)
+ if (!netif_carrier_ok(dev))
+ netif_carrier_on(dev);
+
+- setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
+-
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(open_candev);
+@@ -764,7 +771,7 @@ void close_candev(struct net_device *dev
+ {
+ struct can_priv *priv = netdev_priv(dev);
+
+- del_timer_sync(&priv->restart_timer);
++ cancel_delayed_work_sync(&priv->restart_work);
+ can_flush_echo_skb(dev);
+ }
+ EXPORT_SYMBOL_GPL(close_candev);
+--- a/include/linux/can/dev.h
++++ b/include/linux/can/dev.h
+@@ -32,6 +32,7 @@ enum can_mode {
+ * CAN common private data
+ */
+ struct can_priv {
++ struct net_device *dev;
+ struct can_device_stats can_stats;
+
+ struct can_bittiming bittiming, data_bittiming;
+@@ -47,7 +48,7 @@ struct can_priv {
+ u32 ctrlmode_static; /* static enabled options for driver/hardware */
+
+ int restart_ms;
+- struct timer_list restart_timer;
++ struct delayed_work restart_work;
+
+ int (*do_set_bittiming)(struct net_device *dev);
+ int (*do_set_data_bittiming)(struct net_device *dev);
--- /dev/null
+From 666ca3d8f19082f40745d75f3cc7cc0200ee87e3 Mon Sep 17 00:00:00 2001
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+Date: Fri, 9 Sep 2016 22:34:02 -0400
+Subject: drm/nouveau/fifo/nv04: avoid ramht race against cookie insertion
+
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+
+commit 666ca3d8f19082f40745d75f3cc7cc0200ee87e3 upstream.
+
+Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
+@@ -37,7 +37,10 @@ nv04_fifo_dma_object_dtor(struct nvkm_fi
+ {
+ struct nv04_fifo_chan *chan = nv04_fifo_chan(base);
+ struct nvkm_instmem *imem = chan->fifo->base.engine.subdev.device->imem;
++
++ mutex_lock(&chan->fifo->base.engine.subdev.mutex);
+ nvkm_ramht_remove(imem->ramht, cookie);
++ mutex_unlock(&chan->fifo->base.engine.subdev.mutex);
+ }
+
+ static int
--- /dev/null
+From 670bb4fd21c966d0d2a59ad4a99bb4889f9a2987 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 26 Sep 2016 15:32:50 -0400
+Subject: drm/radeon/si/dpm: add workaround for for Jet parts
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 670bb4fd21c966d0d2a59ad4a99bb4889f9a2987 upstream.
+
+Add clock quirks for Jet parts.
+
+Reviewed-by: Sonny Jiang <sonny.jiang@amd.com>
+Tested-by: Sonny Jiang <sonny.jiang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -3015,6 +3015,12 @@ static void si_apply_state_adjust_rules(
+ if (rdev->pdev->device == 0x6811 &&
+ rdev->pdev->revision == 0x81)
+ max_mclk = 120000;
++ /* limit sclk/mclk on Jet parts for stability */
++ if (rdev->pdev->device == 0x6665 &&
++ rdev->pdev->revision == 0xc3) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
+
+ if (rps->vce_active) {
+ rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
--- /dev/null
+From 90fd68dcf9a763f7e575c8467415bd8a66d073f4 Mon Sep 17 00:00:00 2001
+From: David Herrmann <dh.herrmann@gmail.com>
+Date: Fri, 23 Sep 2016 12:36:02 +0200
+Subject: drm/udl: fix line iterator in damage handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Herrmann <dh.herrmann@gmail.com>
+
+commit 90fd68dcf9a763f7e575c8467415bd8a66d073f4 upstream.
+
+The udl damage handler is supposed to render 'height' lines, but its
+iterator has an obvious typo that makes it miss most lines if the
+rectangle does not cover 0/0.
+
+Fix the damage handler to correctly render all lines.
+
+This is a fallout from:
+
+ commit e375882406d0cc24030746638592004755ed4ae0
+ Author: Noralf Trønnes <noralf@tronnes.org>
+ Date: Thu Apr 28 17:18:37 2016 +0200
+
+ drm/udl: Use drm_fb_helper deferred_io support
+
+Tested-by: poma <poma@gmail.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
+Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/udl/udl_fb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -122,7 +122,7 @@ int udl_handle_damage(struct udl_framebu
+ return 0;
+ cmd = urb->transfer_buffer;
+
+- for (i = y; i < height ; i++) {
++ for (i = y; i < y + height ; i++) {
+ const int line_offset = fb->base.pitches[0] * i;
+ const int byte_offset = line_offset + (x * bpp);
+ const int dev_byte_offset = (fb->base.width * bpp * i) + (x * bpp);
scripts-recordmcount.c-account-for-.softirqentry.text.patch
mtd-nand-davinci-reinitialize-the-hw-ecc-engine-in-4bit-hwctl.patch
mm-ksm-fix-endless-looping-in-allocating-memory-when-ksm-enable.patch
+can-dev-fix-deadlock-reported-after-bus-off.patch
+x86-init-fix-cr4_init_shadow-on-cr4-less-machines.patch
+x86-boot-initialize-fpu-and-x86_feature_always-even-if-we-don-t-have-cpuid.patch
+drm-udl-fix-line-iterator-in-damage-handling.patch
+drm-nouveau-fifo-nv04-avoid-ramht-race-against-cookie-insertion.patch
+drm-radeon-si-dpm-add-workaround-for-for-jet-parts.patch
+arm-8616-1-dt-respect-property-size-when-parsing-cpus.patch
+arm-8617-1-dma-fix-dma_max_pfn.patch
--- /dev/null
+From 05fb3c199bb09f5b85de56cc3ede194ac95c5e1f Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Wed, 28 Sep 2016 16:06:33 -0700
+Subject: x86/boot: Initialize FPU and X86_FEATURE_ALWAYS even if we don't have CPUID
+
+From: Andy Lutomirski <luto@kernel.org>
+
+commit 05fb3c199bb09f5b85de56cc3ede194ac95c5e1f upstream.
+
+Otherwise arch_task_struct_size == 0 and we die. While we're at it,
+set X86_FEATURE_ALWAYS, too.
+
+Reported-by: David Saggiorato <david@saggiorato.net>
+Tested-by: David Saggiorato <david@saggiorato.net>
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Dave Hansen <dave@sr71.net>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: aaeb5c01c5b ("x86/fpu, sched: Introduce CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT and use it on x86")
+Link: http://lkml.kernel.org/r/8de723afbf0811071185039f9088733188b606c9.1475103911.git.luto@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/common.c | 29 ++++++++++++++---------------
+ 1 file changed, 14 insertions(+), 15 deletions(-)
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -804,21 +804,20 @@ static void __init early_identify_cpu(st
+ identify_cpu_without_cpuid(c);
+
+ /* cyrix could have cpuid enabled via c_identify()*/
+- if (!have_cpuid_p())
+- return;
+-
+- cpu_detect(c);
+- get_cpu_vendor(c);
+- get_cpu_cap(c);
+-
+- if (this_cpu->c_early_init)
+- this_cpu->c_early_init(c);
+-
+- c->cpu_index = 0;
+- filter_cpuid_features(c, false);
+-
+- if (this_cpu->c_bsp_init)
+- this_cpu->c_bsp_init(c);
++ if (have_cpuid_p()) {
++ cpu_detect(c);
++ get_cpu_vendor(c);
++ get_cpu_cap(c);
++
++ if (this_cpu->c_early_init)
++ this_cpu->c_early_init(c);
++
++ c->cpu_index = 0;
++ filter_cpuid_features(c, false);
++
++ if (this_cpu->c_bsp_init)
++ this_cpu->c_bsp_init(c);
++ }
+
+ setup_force_cpu_cap(X86_FEATURE_ALWAYS);
+ fpu__init_system(c);
--- /dev/null
+From e1bfc11c5a6f40222a698a818dc269113245820e Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Wed, 28 Sep 2016 12:34:14 -0700
+Subject: x86/init: Fix cr4_init_shadow() on CR4-less machines
+
+From: Andy Lutomirski <luto@kernel.org>
+
+commit e1bfc11c5a6f40222a698a818dc269113245820e upstream.
+
+cr4_init_shadow() will panic on 486-like machines without CR4. Fix
+it using __read_cr4_safe().
+
+Reported-by: david@saggiorato.net
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 1e02ce4cccdc ("x86: Store a per-cpu shadow copy of CR4")
+Link: http://lkml.kernel.org/r/43a20f81fb504013bf613913dc25574b45336a61.1475091074.git.luto@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/asm/tlbflush.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -81,7 +81,7 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct tl
+ /* Initialize cr4 shadow for this CPU. */
+ static inline void cr4_init_shadow(void)
+ {
+- this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
++ this_cpu_write(cpu_tlbstate.cr4, __read_cr4_safe());
+ }
+
+ /* Set in this cpu's CR4. */
projects / thirdparty / kernel / stable-queue.git / commitdiff
