--- /dev/null
+From 79e57dd113d307a6c74773b8aaecf5442068988a Mon Sep 17 00:00:00 2001
+From: "Vittorio Gambaletta (VittGam)" <linux-wireless@vittgam.net>
+Date: Wed, 9 Nov 2016 03:40:56 +0200
+Subject: ath9k: Really fix LED polarity for some Mini PCI AR9220 MB92 cards.
+
+From: Vittorio Gambaletta (VittGam) <linux-wireless@vittgam.net>
+
+commit 79e57dd113d307a6c74773b8aaecf5442068988a upstream.
+
+The active_high LED of my Wistron DNMA-92 is still being recognized as
+active_low on 4.7.6 mainline. When I was preparing my former commit
+0f9edcdd88a9 ("ath9k: Fix LED polarity for some Mini PCI AR9220 MB92
+cards.") to fix that I must have somehow messed up with testing, because
+I tested the final version of that patch before sending it, and it was
+apparently working; but now it is not working on 4.7.6 mainline.
+
+I initially added the PCI_DEVICE_SUB section for 0x0029/0x2096 above the
+PCI_VDEVICE section for 0x0029; but then I moved the former below the
+latter after seeing how 0x002A sections were sorted in the file.
+
+This turned out to be wrong: if a generic PCI_VDEVICE entry (that has
+both subvendor and subdevice IDs set to PCI_ANY_ID) is put before a more
+specific one (PCI_DEVICE_SUB), then the generic PCI_VDEVICE entry will
+match first and will be used.
+
+With this patch, 0x0029/0x2096 has finally got active_high LED on 4.7.6.
+
+While I'm at it, let's fix 0x002A too by also moving its generic definition
+below its specific ones.
+
+Fixes: 0f9edcdd88a9 ("ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards.")
+Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
+[kvalo@qca.qualcomm.com: improve the commit log based on email discussions]
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/pci.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/pci.c
++++ b/drivers/net/wireless/ath/ath9k/pci.c
+@@ -27,7 +27,6 @@ static const struct pci_device_id ath_pc
+ { PCI_VDEVICE(ATHEROS, 0x0023) }, /* PCI */
+ { PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
+ { PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI */
+- { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */
+
+ #ifdef CONFIG_ATH9K_PCOEM
+ /* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */
+@@ -38,7 +37,7 @@ static const struct pci_device_id ath_pc
+ .driver_data = ATH9K_PCI_LED_ACT_HI },
+ #endif
+
+- { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
++ { PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI */
+
+ #ifdef CONFIG_ATH9K_PCOEM
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+@@ -86,7 +85,11 @@ static const struct pci_device_id ath_pc
+ 0x10CF, /* Fujitsu */
+ 0x1536),
+ .driver_data = ATH9K_PCI_D3_L1_WAR },
++#endif
+
++ { PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
++
++#ifdef CONFIG_ATH9K_PCOEM
+ /* AR9285 card for Asus */
+ { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+ 0x002B,
--- /dev/null
+From e6f462df9acd2a3295e5d34eb29e2823220cf129 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 8 Dec 2016 17:22:09 +0100
+Subject: cfg80211/mac80211: fix BSS leaks when abandoning assoc attempts
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit e6f462df9acd2a3295e5d34eb29e2823220cf129 upstream.
+
+When mac80211 abandons an association attempt, it may free
+all the data structures, but inform cfg80211 and userspace
+about it only by sending the deauth frame it received, in
+which case cfg80211 has no link to the BSS struct that was
+used and will not cfg80211_unhold_bss() it.
+
+Fix this by providing a way to inform cfg80211 of this with
+the BSS entry passed, so that it can clean up properly, and
+use this ability in the appropriate places in mac80211.
+
+This isn't ideal: some code is more or less duplicated and
+tracing is missing. However, it's a fairly small change and
+it's thus easier to backport - cleanups can come later.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/cfg80211.h | 11 +++++++++++
+ net/mac80211/mlme.c | 21 ++++++++++++---------
+ net/wireless/core.h | 1 +
+ net/wireless/mlme.c | 12 ++++++++++++
+ net/wireless/sme.c | 14 ++++++++++++++
+ 5 files changed, 50 insertions(+), 9 deletions(-)
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -4258,6 +4258,17 @@ void cfg80211_rx_assoc_resp(struct net_d
+ void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss);
+
+ /**
++ * cfg80211_abandon_assoc - notify cfg80211 of abandoned association attempt
++ * @dev: network device
++ * @bss: The BSS entry with which association was abandoned.
++ *
++ * Call this whenever - for reasons reported through other API, like deauth RX,
++ * an association attempt was abandoned.
++ * This function may sleep. The caller must hold the corresponding wdev's mutex.
++ */
++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss);
++
++/**
+ * cfg80211_tx_mlme_mgmt - notification of transmitted deauth/disassoc frame
+ * @dev: network device
+ * @buf: 802.11 frame (header + body)
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2517,7 +2517,7 @@ static void ieee80211_destroy_auth_data(
+ }
+
+ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
+- bool assoc)
++ bool assoc, bool abandon)
+ {
+ struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
+
+@@ -2539,6 +2539,9 @@ static void ieee80211_destroy_assoc_data
+ mutex_lock(&sdata->local->mtx);
+ ieee80211_vif_release_channel(sdata);
+ mutex_unlock(&sdata->local->mtx);
++
++ if (abandon)
++ cfg80211_abandon_assoc(sdata->dev, assoc_data->bss);
+ }
+
+ kfree(assoc_data);
+@@ -2768,7 +2771,7 @@ static void ieee80211_rx_mgmt_deauth(str
+ bssid, reason_code,
+ ieee80211_get_reason_code_string(reason_code));
+
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, true);
+
+ cfg80211_rx_mlme_mgmt(sdata->dev, (u8 *)mgmt, len);
+ return;
+@@ -3173,14 +3176,14 @@ static void ieee80211_rx_mgmt_assoc_resp
+ if (status_code != WLAN_STATUS_SUCCESS) {
+ sdata_info(sdata, "%pM denied association (code=%d)\n",
+ mgmt->sa, status_code);
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, false);
+ event.u.mlme.status = MLME_DENIED;
+ event.u.mlme.reason = status_code;
+ drv_event_callback(sdata->local, sdata, &event);
+ } else {
+ if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
+ /* oops -- internal error -- send timeout for now */
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, false);
+ cfg80211_assoc_timeout(sdata->dev, bss);
+ return;
+ }
+@@ -3193,7 +3196,7 @@ static void ieee80211_rx_mgmt_assoc_resp
+ * recalc after assoc_data is NULL but before associated
+ * is set can cause the interface to go idle
+ */
+- ieee80211_destroy_assoc_data(sdata, true);
++ ieee80211_destroy_assoc_data(sdata, true, false);
+
+ /* get uapsd queues configuration */
+ uapsd_queues = 0;
+@@ -3888,7 +3891,7 @@ void ieee80211_sta_work(struct ieee80211
+ .u.mlme.status = MLME_TIMEOUT,
+ };
+
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, false);
+ cfg80211_assoc_timeout(sdata->dev, bss);
+ drv_event_callback(sdata->local, sdata, &event);
+ }
+@@ -4029,7 +4032,7 @@ void ieee80211_mgd_quiesce(struct ieee80
+ WLAN_REASON_DEAUTH_LEAVING,
+ false, frame_buf);
+ if (ifmgd->assoc_data)
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, true);
+ if (ifmgd->auth_data)
+ ieee80211_destroy_auth_data(sdata, false);
+ cfg80211_tx_mlme_mgmt(sdata->dev, frame_buf,
+@@ -4905,7 +4908,7 @@ int ieee80211_mgd_deauth(struct ieee8021
+ IEEE80211_STYPE_DEAUTH,
+ req->reason_code, tx,
+ frame_buf);
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, true);
+ ieee80211_report_disconnect(sdata, frame_buf,
+ sizeof(frame_buf), true,
+ req->reason_code);
+@@ -4980,7 +4983,7 @@ void ieee80211_mgd_stop(struct ieee80211
+ sdata_lock(sdata);
+ if (ifmgd->assoc_data) {
+ struct cfg80211_bss *bss = ifmgd->assoc_data->bss;
+- ieee80211_destroy_assoc_data(sdata, false);
++ ieee80211_destroy_assoc_data(sdata, false, false);
+ cfg80211_assoc_timeout(sdata->dev, bss);
+ }
+ if (ifmgd->auth_data)
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -398,6 +398,7 @@ void cfg80211_sme_disassoc(struct wirele
+ void cfg80211_sme_deauth(struct wireless_dev *wdev);
+ void cfg80211_sme_auth_timeout(struct wireless_dev *wdev);
+ void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev);
++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev);
+
+ /* internal helpers */
+ bool cfg80211_supported_cipher_suite(struct wiphy *wiphy, u32 cipher);
+--- a/net/wireless/mlme.c
++++ b/net/wireless/mlme.c
+@@ -149,6 +149,18 @@ void cfg80211_assoc_timeout(struct net_d
+ }
+ EXPORT_SYMBOL(cfg80211_assoc_timeout);
+
++void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
++{
++ struct wireless_dev *wdev = dev->ieee80211_ptr;
++ struct wiphy *wiphy = wdev->wiphy;
++
++ cfg80211_sme_abandon_assoc(wdev);
++
++ cfg80211_unhold_bss(bss_from_pub(bss));
++ cfg80211_put_bss(wiphy, bss);
++}
++EXPORT_SYMBOL(cfg80211_abandon_assoc);
++
+ void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
+ {
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
+--- a/net/wireless/sme.c
++++ b/net/wireless/sme.c
+@@ -39,6 +39,7 @@ struct cfg80211_conn {
+ CFG80211_CONN_ASSOCIATING,
+ CFG80211_CONN_ASSOC_FAILED,
+ CFG80211_CONN_DEAUTH,
++ CFG80211_CONN_ABANDON,
+ CFG80211_CONN_CONNECTED,
+ } state;
+ u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
+@@ -204,6 +205,8 @@ static int cfg80211_conn_do_work(struct
+ cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+ NULL, 0,
+ WLAN_REASON_DEAUTH_LEAVING, false);
++ /* fall through */
++ case CFG80211_CONN_ABANDON:
+ /* free directly, disconnected event already sent */
+ cfg80211_sme_free(wdev);
+ return 0;
+@@ -423,6 +426,17 @@ void cfg80211_sme_assoc_timeout(struct w
+ schedule_work(&rdev->conn_work);
+ }
+
++void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev)
++{
++ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
++
++ if (!wdev->conn)
++ return;
++
++ wdev->conn->state = CFG80211_CONN_ABANDON;
++ schedule_work(&rdev->conn_work);
++}
++
+ static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
+ const u8 *ies, size_t ies_len,
+ const u8 **out_ies, size_t *out_ies_len)
--- /dev/null
+From 68af4fa8f39b542a6cde7ac19518d88e9b3099dc Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+Date: Thu, 1 Dec 2016 20:27:21 +0100
+Subject: clk: bcm2835: Avoid overwriting the div info when disabling a pll_div clk
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+commit 68af4fa8f39b542a6cde7ac19518d88e9b3099dc upstream.
+
+bcm2835_pll_divider_off() is resetting the divider field in the A2W reg
+to zero when disabling the clock.
+
+Make sure we preserve this value by reading the previous a2w_reg value
+first and ORing the result with A2W_PLL_CHANNEL_DISABLE.
+
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Fixes: 41691b8862e2 ("clk: bcm2835: Add support for programming the audio domain clocks")
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/bcm/clk-bcm2835.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/bcm/clk-bcm2835.c
++++ b/drivers/clk/bcm/clk-bcm2835.c
+@@ -1082,7 +1082,9 @@ static void bcm2835_pll_divider_off(stru
+ cprman_write(cprman, data->cm_reg,
+ (cprman_read(cprman, data->cm_reg) &
+ ~data->load_mask) | data->hold_mask);
+- cprman_write(cprman, data->a2w_reg, A2W_PLL_CHANNEL_DISABLE);
++ cprman_write(cprman, data->a2w_reg,
++ cprman_read(cprman, data->a2w_reg) |
++ A2W_PLL_CHANNEL_DISABLE);
+ spin_unlock(&cprman->regs_lock);
+ }
+
--- /dev/null
+From 61e53bd0047d58caee0c7170613045bf96de4458 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 2 Dec 2016 15:14:20 +0200
+Subject: mmc: sdhci: Fix recovery from tuning timeout
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 61e53bd0047d58caee0c7170613045bf96de4458 upstream.
+
+Clearing the tuning bits should reset the tuning circuit. However there is
+more to do. Reset the command and data lines for good measure, and then
+for eMMC ensure the card is not still trying to process a tuning command by
+sending a stop command.
+
+Note the JEDEC eMMC specification says the stop command (CMD12) can be used
+to stop a tuning command (CMD21) whereas the SD specification is silent on
+the subject with respect to the SD tuning command (CMD19). Considering that
+CMD12 is not a valid SDIO command, the stop command is sent only when the
+tuning command is CMD21 i.e. for eMMC. That addresses cases seen so far
+which have been on eMMC.
+
+Note that this replaces the commit fe5fb2e3b58f ("mmc: sdhci: Reset cmd and
+data circuits after tuning failure") which is being reverted for v4.9+.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Tested-by: Dan O'Donovan <dan@emutex.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2040,7 +2040,27 @@ static int sdhci_execute_tuning(struct m
+ ctrl &= ~SDHCI_CTRL_EXEC_TUNING;
+ sdhci_writew(host, ctrl, SDHCI_HOST_CONTROL2);
+
++ sdhci_do_reset(host, SDHCI_RESET_CMD);
++ sdhci_do_reset(host, SDHCI_RESET_DATA);
++
+ err = -EIO;
++
++ if (cmd.opcode != MMC_SEND_TUNING_BLOCK_HS200)
++ goto out;
++
++ sdhci_writel(host, host->ier, SDHCI_INT_ENABLE);
++ sdhci_writel(host, host->ier, SDHCI_SIGNAL_ENABLE);
++
++ spin_unlock_irqrestore(&host->lock, flags);
++
++ memset(&cmd, 0, sizeof(cmd));
++ cmd.opcode = MMC_STOP_TRANSMISSION;
++ cmd.flags = MMC_RSP_SPI_R1B | MMC_RSP_R1B | MMC_CMD_AC;
++ cmd.busy_timeout = 50;
++ mmc_wait_for_cmd(mmc, &cmd, 0);
++
++ spin_lock_irqsave(&host->lock, flags);
++
+ goto out;
+ }
+
--- /dev/null
+From 295070e9aa015abb9b92cccfbb1e43954e938133 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Sat, 12 Nov 2016 15:22:38 +0100
+Subject: regulator: stw481x-vmmc: fix ages old enable error
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 295070e9aa015abb9b92cccfbb1e43954e938133 upstream.
+
+The regulator has never been properly enabled, it has been
+dormant all the time. It's strange that MMC was working
+at all, but it likely worked by the signals going through
+the levelshifter and reaching the card anyways.
+
+Fixes: 3615a34ea1a6 ("regulator: add STw481x VMMC driver")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/stw481x-vmmc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/stw481x-vmmc.c
++++ b/drivers/regulator/stw481x-vmmc.c
+@@ -47,7 +47,8 @@ static struct regulator_desc vmmc_regula
+ .volt_table = stw481x_vmmc_voltages,
+ .enable_time = 200, /* FIXME: look this up */
+ .enable_reg = STW_CONF1,
+- .enable_mask = STW_CONF1_PDN_VMMC,
++ .enable_mask = STW_CONF1_PDN_VMMC | STW_CONF1_MMC_LS_STATUS,
++ .enable_val = STW_CONF1_PDN_VMMC,
+ .vsel_reg = STW_CONF1,
+ .vsel_mask = STW_CONF1_VMMC_MASK,
+ };
--- /dev/null
+From ba9f93f82abafe2552eac942ebb11c2df4f8dd7f Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 26 Nov 2016 14:43:35 -0600
+Subject: rtlwifi: Fix enter/exit power_save
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit ba9f93f82abafe2552eac942ebb11c2df4f8dd7f upstream.
+
+In commit a5ffbe0a1993 ("rtlwifi: Fix scheduling while atomic bug") and
+commit a269913c52ad ("rtlwifi: Rework rtl_lps_leave() and rtl_lps_enter()
+to use work queue"), an error was introduced in the power-save routines
+due to the fact that leaving PS was delayed by the use of a work queue.
+
+This problem is fixed by detecting if the enter or leave routines are
+in interrupt mode. If so, the workqueue is used to place the request.
+If in normal mode, the enter or leave routines are called directly.
+
+Fixes: a269913c52ad ("rtlwifi: Rework rtl_lps_leave() and rtl_lps_enter() to use work queue")
+Reported-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 8 +++---
+ drivers/net/wireless/realtek/rtlwifi/core.c | 9 ++-----
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 14 +++-------
+ drivers/net/wireless/realtek/rtlwifi/ps.c | 36 +++++++++++++++++++++-------
+ 4 files changed, 40 insertions(+), 27 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -1303,12 +1303,13 @@ EXPORT_SYMBOL_GPL(rtl_action_proc);
+
+ static void setup_arp_tx(struct rtl_priv *rtlpriv, struct rtl_ps_ctl *ppsc)
+ {
++ struct ieee80211_hw *hw = rtlpriv->hw;
++
+ rtlpriv->ra.is_special_data = true;
+ if (rtlpriv->cfg->ops->get_btc_status())
+ rtlpriv->btcoexist.btc_ops->btc_special_packet_notify(
+ rtlpriv, 1);
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
++ rtl_lps_leave(hw);
+ ppsc->last_delaylps_stamp_jiffies = jiffies;
+ }
+
+@@ -1381,8 +1382,7 @@ u8 rtl_is_special_data(struct ieee80211_
+
+ if (is_tx) {
+ rtlpriv->ra.is_special_data = true;
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
++ rtl_lps_leave(hw);
+ ppsc->last_delaylps_stamp_jiffies = jiffies;
+ }
+
+--- a/drivers/net/wireless/realtek/rtlwifi/core.c
++++ b/drivers/net/wireless/realtek/rtlwifi/core.c
+@@ -1153,10 +1153,8 @@ static void rtl_op_bss_info_changed(stru
+ } else {
+ mstatus = RT_MEDIA_DISCONNECT;
+
+- if (mac->link_state == MAC80211_LINKED) {
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
+- }
++ if (mac->link_state == MAC80211_LINKED)
++ rtl_lps_leave(hw);
+ if (ppsc->p2p_ps_info.p2p_ps_mode > P2P_PS_NONE)
+ rtl_p2p_ps_cmd(hw, P2P_PS_DISABLE);
+ mac->link_state = MAC80211_NOLINK;
+@@ -1432,8 +1430,7 @@ static void rtl_op_sw_scan_start(struct
+ }
+
+ if (mac->link_state == MAC80211_LINKED) {
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
++ rtl_lps_leave(hw);
+ mac->link_state = MAC80211_LINKED_SCANNING;
+ } else {
+ rtl_ips_nic_on(hw);
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -664,11 +664,9 @@ tx_status_ok:
+ }
+
+ if (((rtlpriv->link_info.num_rx_inperiod +
+- rtlpriv->link_info.num_tx_inperiod) > 8) ||
+- (rtlpriv->link_info.num_rx_inperiod > 2)) {
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
+- }
++ rtlpriv->link_info.num_tx_inperiod) > 8) ||
++ (rtlpriv->link_info.num_rx_inperiod > 2))
++ rtl_lps_leave(hw);
+ }
+
+ static int _rtl_pci_init_one_rxdesc(struct ieee80211_hw *hw,
+@@ -919,10 +917,8 @@ new_trx_end:
+ }
+ if (((rtlpriv->link_info.num_rx_inperiod +
+ rtlpriv->link_info.num_tx_inperiod) > 8) ||
+- (rtlpriv->link_info.num_rx_inperiod > 2)) {
+- rtlpriv->enter_ps = false;
+- schedule_work(&rtlpriv->works.lps_change_work);
+- }
++ (rtlpriv->link_info.num_rx_inperiod > 2))
++ rtl_lps_leave(hw);
+ skb = new_skb;
+ no_new:
+ if (rtlpriv->use_new_trx_flow) {
+--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
+@@ -414,8 +414,8 @@ void rtl_lps_set_psmode(struct ieee80211
+ }
+ }
+
+-/*Enter the leisure power save mode.*/
+-void rtl_lps_enter(struct ieee80211_hw *hw)
++/* Interrupt safe routine to enter the leisure power save mode.*/
++static void rtl_lps_enter_core(struct ieee80211_hw *hw)
+ {
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+ struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+@@ -455,10 +455,9 @@ void rtl_lps_enter(struct ieee80211_hw *
+
+ spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
+ }
+-EXPORT_SYMBOL(rtl_lps_enter);
+
+-/*Leave the leisure power save mode.*/
+-void rtl_lps_leave(struct ieee80211_hw *hw)
++/* Interrupt safe routine to leave the leisure power save mode.*/
++static void rtl_lps_leave_core(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+@@ -488,7 +487,6 @@ void rtl_lps_leave(struct ieee80211_hw *
+ }
+ spin_unlock_irqrestore(&rtlpriv->locks.lps_lock, flag);
+ }
+-EXPORT_SYMBOL(rtl_lps_leave);
+
+ /* For sw LPS*/
+ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
+@@ -681,12 +679,34 @@ void rtl_lps_change_work_callback(struct
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+ if (rtlpriv->enter_ps)
+- rtl_lps_enter(hw);
++ rtl_lps_enter_core(hw);
+ else
+- rtl_lps_leave(hw);
++ rtl_lps_leave_core(hw);
+ }
+ EXPORT_SYMBOL_GPL(rtl_lps_change_work_callback);
+
++void rtl_lps_enter(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++
++ if (!in_interrupt())
++ return rtl_lps_enter_core(hw);
++ rtlpriv->enter_ps = true;
++ schedule_work(&rtlpriv->works.lps_change_work);
++}
++EXPORT_SYMBOL_GPL(rtl_lps_enter);
++
++void rtl_lps_leave(struct ieee80211_hw *hw)
++{
++ struct rtl_priv *rtlpriv = rtl_priv(hw);
++
++ if (!in_interrupt())
++ return rtl_lps_leave_core(hw);
++ rtlpriv->enter_ps = false;
++ schedule_work(&rtlpriv->works.lps_change_work);
++}
++EXPORT_SYMBOL_GPL(rtl_lps_leave);
++
+ void rtl_swlps_wq_callback(void *data)
+ {
+ struct rtl_works *rtlworks = container_of_dwork_rtl(data,
--- /dev/null
+ssb-fix-error-routine-when-fallback-sprom-fails.patch
+rtlwifi-fix-enter-exit-power_save.patch
+cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch
+ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch
+mmc-sdhci-fix-recovery-from-tuning-timeout.patch
+regulator-stw481x-vmmc-fix-ages-old-enable-error.patch
+timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch
+clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch
+thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch
--- /dev/null
+From 8052d7245b6089992343c80b38b14dbbd8354651 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Sat, 5 Nov 2016 14:08:57 -0500
+Subject: ssb: Fix error routine when fallback SPROM fails
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 8052d7245b6089992343c80b38b14dbbd8354651 upstream.
+
+When there is a CRC error in the SPROM read from the device, the code
+attempts to handle a fallback SPROM. When this also fails, the driver
+returns zero rather than an error code.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ssb/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ssb/pci.c
++++ b/drivers/ssb/pci.c
+@@ -909,6 +909,7 @@ static int ssb_pci_sprom_get(struct ssb_
+ if (err) {
+ ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n",
+ err);
++ goto out_free;
+ } else {
+ ssb_dbg("Using SPROM revision %d provided by platform\n",
+ sprom->revision);
--- /dev/null
+From f37fabb8643eaf8e3b613333a72f683770c85eca Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Tue, 22 Nov 2016 19:22:44 +0200
+Subject: thermal: hwmon: Properly report critical temperature in sysfs
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+commit f37fabb8643eaf8e3b613333a72f683770c85eca upstream.
+
+In the critical sysfs entry the thermal hwmon was returning wrong
+temperature to the user-space. It was reporting the temperature of the
+first trip point instead of the temperature of critical trip point.
+
+For example:
+ /sys/class/hwmon/hwmon0/temp1_crit:50000
+ /sys/class/thermal/thermal_zone0/trip_point_0_temp:50000
+ /sys/class/thermal/thermal_zone0/trip_point_0_type:active
+ /sys/class/thermal/thermal_zone0/trip_point_3_temp:120000
+ /sys/class/thermal/thermal_zone0/trip_point_3_type:critical
+
+Since commit e68b16abd91d ("thermal: add hwmon sysfs I/F") the driver
+have been registering a sysfs entry if get_crit_temp() callback was
+provided. However when accessed, it was calling get_trip_temp() instead
+of the get_crit_temp().
+
+Fixes: e68b16abd91d ("thermal: add hwmon sysfs I/F")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/thermal/thermal_hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/thermal/thermal_hwmon.c
++++ b/drivers/thermal/thermal_hwmon.c
+@@ -98,7 +98,7 @@ temp_crit_show(struct device *dev, struc
+ int temperature;
+ int ret;
+
+- ret = tz->ops->get_trip_temp(tz, 0, &temperature);
++ ret = tz->ops->get_crit_temp(tz, &temperature);
+ if (ret)
+ return ret;
+
--- /dev/null
+From 9c1645727b8fa90d07256fdfcc45bf831242a3ab Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Thu, 8 Dec 2016 20:49:32 +0000
+Subject: timekeeping_Force_unsigned_clocksource_to_nanoseconds_conversion
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 9c1645727b8fa90d07256fdfcc45bf831242a3ab upstream.
+
+The clocksource delta to nanoseconds conversion is using signed math, but
+the delta is unsigned. This makes the conversion space smaller than
+necessary and in case of a multiplication overflow the conversion can
+become negative. The conversion is done with scaled math:
+
+ s64 nsec_delta = ((s64)clkdelta * clk->mult) >> clk->shift;
+
+Shifting a signed integer right obvioulsy preserves the sign, which has
+interesting consequences:
+
+ - Time jumps backwards
+
+ - __iter_div_u64_rem() which is used in one of the calling code pathes
+ will take forever to piecewise calculate the seconds/nanoseconds part.
+
+This has been reported by several people with different scenarios:
+
+David observed that when stopping a VM with a debugger:
+
+ "It was essentially the stopped by debugger case. I forget exactly why,
+ but the guest was being explicitly stopped from outside, it wasn't just
+ scheduling lag. I think it was something in the vicinity of 10 minutes
+ stopped."
+
+ When lifting the stop the machine went dead.
+
+The stopped by debugger case is not really interesting, but nevertheless it
+would be a good thing not to die completely.
+
+But this was also observed on a live system by Liav:
+
+ "When the OS is too overloaded, delta will get a high enough value for the
+ msb of the sum delta * tkr->mult + tkr->xtime_nsec to be set, and so
+ after the shift the nsec variable will gain a value similar to
+ 0xffffffffff000000."
+
+Unfortunately this has been reintroduced recently with commit 6bd58f09e1d8
+("time: Add cycles to nanoseconds translation"). It had been fixed a year
+ago already in commit 35a4933a8959 ("time: Avoid signed overflow in
+timekeeping_get_ns()").
+
+Though it's not surprising that the issue has been reintroduced because the
+function itself and the whole call chain uses s64 for the result and the
+propagation of it. The change in this recent commit is subtle:
+
+ s64 nsec;
+
+- nsec = (d * m + n) >> s:
++ nsec = d * m + n;
++ nsec >>= s;
+
+d being type of cycle_t adds another level of obfuscation.
+
+This wouldn't have happened if the previous change to unsigned computation
+would have made the 'nsec' variable u64 right away and a follow up patch
+had cleaned up the whole call chain.
+
+There have been patches submitted which basically did a revert of the above
+patch leaving everything else unchanged as signed. Back to square one. This
+spawned a admittedly pointless discussion about potential users which rely
+on the unsigned behaviour until someone pointed out that it had been fixed
+before. The changelogs of said patches added further confusion as they made
+finally false claims about the consequences for eventual users which expect
+signed results.
+
+Despite delta being cycle_t, aka. u64, it's very well possible to hand in
+a signed negative value and the signed computation will happily return the
+correct result. But nobody actually sat down and analyzed the code which
+was added as user after the propably unintended signed conversion.
+
+Though in sensitive code like this it's better to analyze it proper and
+make sure that nothing relies on this than hunting the subtle wreckage half
+a year later. After analyzing all call chains it stands that no caller can
+hand in a negative value (which actually would work due to the s64 cast)
+and rely on the signed math to do the right thing.
+
+Change the conversion function to unsigned math. The conversion of all call
+chains is done in a follow up patch.
+
+This solves the starvation issue, which was caused by the negative result,
+but it does not solve the underlying problem. It merily procrastinates
+it. When the timekeeper update is deferred long enough that the unsigned
+multiplication overflows, then time going backwards is observable again.
+
+It does neither solve the issue of clocksources with a small counter width
+which will wrap around possibly several times and cause random time stamps
+to be generated. But those are usually not found on systems used for
+virtualization, so this is likely a non issue.
+
+I took the liberty to claim authorship for this simply because
+analyzing all callsites and writing the changelog took substantially
+more time than just making the simple s/s64/u64/ change and ignore the
+rest.
+
+Fixes: 6bd58f09e1d8 ("time: Add cycles to nanoseconds translation")
+Reported-by: David Gibson <david@gibson.dropbear.id.au>
+Reported-by: Liav Rehana <liavr@mellanox.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Parit Bhargava <prarit@redhat.com>
+Cc: Laurent Vivier <lvivier@redhat.com>
+Cc: "Christopher S. Hall" <christopher.s.hall@intel.com>
+Cc: Chris Metcalf <cmetcalf@mellanox.com>
+Cc: Richard Cochran <richardcochran@gmail.com>
+Cc: John Stultz <john.stultz@linaro.org>
+Link: http://lkml.kernel.org/r/20161208204228.688545601@linutronix.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/timekeeping.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -298,10 +298,10 @@ u32 (*arch_gettimeoffset)(void) = defaul
+ static inline u32 arch_gettimeoffset(void) { return 0; }
+ #endif
+
+-static inline s64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
++static inline u64 timekeeping_delta_to_ns(struct tk_read_base *tkr,
+ cycle_t delta)
+ {
+- s64 nsec;
++ u64 nsec;
+
+ nsec = delta * tkr->mult + tkr->xtime_nsec;
+ nsec >>= tkr->shift;
--- /dev/null
+ssb-fix-error-routine-when-fallback-sprom-fails.patch
+rtlwifi-fix-enter-exit-power_save.patch
+perf-x86-fix-exclusion-of-bts-and-lbr-for-goldmont.patch
+perf-x86-intel-cstate-prevent-hotplug-callback-leak.patch
+rtl8xxxu-work-around-issue-with-8192eu-and-8723bu-devices-not-reconnecting.patch
+cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch
+ath9k-fix-ath9k_hw_gpio_get-to-return-0-or-1-on-success.patch
+ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch
+mmc-sdhci-fix-recovery-from-tuning-timeout.patch
+regulator-stw481x-vmmc-fix-ages-old-enable-error.patch
+timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch
+gpio-chardev-return-error-for-seek-operations.patch
+arm64-tegra-add-vdd_gpu-regulator-to-jetson-tx1.patch
+clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch
+thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch
--- /dev/null
+ssb-fix-error-routine-when-fallback-sprom-fails.patch
+ath10k-fix-soft-lockup-during-firmware-crash-hw-restart.patch
+rtlwifi-fix-enter-exit-power_save.patch
+perf-x86-fix-exclusion-of-bts-and-lbr-for-goldmont.patch
+perf-annotate-don-t-throw-error-for-zero-length-symbols.patch
+perf-x86-intel-cstate-prevent-hotplug-callback-leak.patch
+rtl8xxxu-work-around-issue-with-8192eu-and-8723bu-devices-not-reconnecting.patch
+cfg80211-mac80211-fix-bss-leaks-when-abandoning-assoc-attempts.patch
+ath9k-fix-ath9k_hw_gpio_get-to-return-0-or-1-on-success.patch
+ath9k-really-fix-led-polarity-for-some-mini-pci-ar9220-mb92-cards.patch
+ath9k-do-not-return-early-to-fix-rcu-unlocking.patch
+revert-mmc-sdhci-reset-cmd-and-data-circuits-after-tuning-failure.patch
+mmc-sdhci-fix-recovery-from-tuning-timeout.patch
+regulator-stw481x-vmmc-fix-ages-old-enable-error.patch
+mmc-sd-meet-alignment-requirements-for-raw_ssr-dma.patch
+timekeeping_force_unsigned_clocksource_to_nanoseconds_conversion.patch
+gpio-stmpe-fix-interrupt-handling-bug.patch
+gpio-chardev-return-error-for-seek-operations.patch
+arm64-tegra-add-vdd_gpu-regulator-to-jetson-tx1.patch
+clk-bcm2835-avoid-overwriting-the-div-info-when-disabling-a-pll_div-clk.patch
+thermal-hwmon-properly-report-critical-temperature-in-sysfs.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
