--- /dev/null
+From b9a5e5e18fbf223502c0b2264c15024e393da928 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 7 May 2015 21:19:39 +0200
+Subject: ACPI / init: Fix the ordering of acpi_reserve_resources()
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+commit b9a5e5e18fbf223502c0b2264c15024e393da928 upstream.
+
+Since acpi_reserve_resources() is defined as a device_initcall(),
+there's no guarantee that it will be executed in the right order
+with respect to the rest of the ACPI initialization code. On some
+systems this leads to breakage if, for example, the address range
+that should be reserved for the ACPI fixed registers is given to
+the PCI host bridge instead if the race is won by the wrong code
+path.
+
+Fix this by turning acpi_reserve_resources() into a void function
+and calling it directly from within the ACPI initialization sequence.
+
+Reported-and-tested-by: George McCollister <george.mccollister@gmail.com>
+Link: http://marc.info/?t=143092384600002&r=1&w=2
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/osl.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -182,7 +182,7 @@ static void __init acpi_request_region (
+ request_mem_region(addr, length, desc);
+ }
+
+-static int __init acpi_reserve_resources(void)
++static void __init acpi_reserve_resources(void)
+ {
+ acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
+ "ACPI PM1a_EVT_BLK");
+@@ -211,10 +211,7 @@ static int __init acpi_reserve_resources
+ if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
+ acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
+ acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+-
+- return 0;
+ }
+-device_initcall(acpi_reserve_resources);
+
+ void acpi_os_printf(const char *fmt, ...)
+ {
+@@ -1845,6 +1842,7 @@ acpi_status __init acpi_os_initialize(vo
+
+ acpi_status __init acpi_os_initialize1(void)
+ {
++ acpi_reserve_resources();
+ kacpid_wq = alloc_workqueue("kacpid", 0, 1);
+ kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
+ kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0);
--- /dev/null
+From daaf40e53b5dbdf75255d58a45ce8ac65ca511a8 Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Sun, 10 May 2015 12:04:01 +0530
+Subject: ARC: unbork !LLSC build
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit daaf40e53b5dbdf75255d58a45ce8ac65ca511a8 upstream.
+
+Fixes: f7d11e93ee97a locking,arch,arc: Fold atomic_ops
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/include/asm/atomic.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arc/include/asm/atomic.h
++++ b/arch/arc/include/asm/atomic.h
+@@ -99,7 +99,7 @@ static inline void atomic_##op(int i, at
+ atomic_ops_unlock(flags); \
+ }
+
+-#define ATOMIC_OP_RETURN(op, c_op) \
++#define ATOMIC_OP_RETURN(op, c_op, asm_op) \
+ static inline int atomic_##op##_return(int i, atomic_t *v) \
+ { \
+ unsigned long flags; \
--- /dev/null
+From 1c220c69ce0dcc0f234a9f263ad9c0864f971852 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Fri, 29 May 2015 14:52:51 +0100
+Subject: dm: fix casting bug in dm_merge_bvec()
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 1c220c69ce0dcc0f234a9f263ad9c0864f971852 upstream.
+
+dm_merge_bvec() was originally added in f6fccb ("dm: introduce
+merge_bvec_fn"). In that commit a value in sectors is converted to
+bytes using << 9, and then assigned to an int. This code made
+assumptions about the value of BIO_MAX_SECTORS.
+
+A later commit 148e51 ("dm: improve documentation and code clarity in
+dm_merge_bvec") was meant to have no functional change but it removed
+the use of BIO_MAX_SECTORS in favor of using queue_max_sectors(). At
+this point the cast from sector_t to int resulted in a zero value. The
+fallout being dm_merge_bvec() would only allow a single page to be added
+to a bio.
+
+This interim fix is minimal for the benefit of stable@ because the more
+comprehensive cleanup of passing a sector_t to all DM targets' merge
+function will impact quite a few DM targets.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1642,8 +1642,7 @@ static int dm_merge_bvec(struct request_
+ struct mapped_device *md = q->queuedata;
+ struct dm_table *map = dm_get_live_table_fast(md);
+ struct dm_target *ti;
+- sector_t max_sectors;
+- int max_size = 0;
++ sector_t max_sectors, max_size = 0;
+
+ if (unlikely(!map))
+ goto out;
+@@ -1658,8 +1657,16 @@ static int dm_merge_bvec(struct request_
+ max_sectors = min(max_io_len(bvm->bi_sector, ti),
+ (sector_t) queue_max_sectors(q));
+ max_size = (max_sectors << SECTOR_SHIFT) - bvm->bi_size;
+- if (unlikely(max_size < 0)) /* this shouldn't _ever_ happen */
+- max_size = 0;
++
++ /*
++ * FIXME: this stop-gap fix _must_ be cleaned up (by passing a sector_t
++ * to the targets' merge function since it holds sectors not bytes).
++ * Just doing this as an interim fix for stable@ because the more
++ * comprehensive cleanup of switching to sector_t will impact every
++ * DM target that implements a ->merge hook.
++ */
++ if (max_size > INT_MAX)
++ max_size = INT_MAX;
+
+ /*
+ * merge_bvec_fn() returns number of bytes
+@@ -1667,7 +1674,7 @@ static int dm_merge_bvec(struct request_
+ * max is precomputed maximal io size
+ */
+ if (max_size && ti->type->merge)
+- max_size = ti->type->merge(ti, bvm, biovec, max_size);
++ max_size = ti->type->merge(ti, bvm, biovec, (int) max_size);
+ /*
+ * If the target doesn't support merge method and some of the devices
+ * provided their merge_bvec method (we know this by looking for the
--- /dev/null
+From 15b94a690470038aa08247eedbebbe7e2218d5ee Mon Sep 17 00:00:00 2001
+From: Junichi Nomura <j-nomura@ce.jp.nec.com>
+Date: Fri, 29 May 2015 08:51:03 +0000
+Subject: dm: fix reload failure of 0 path multipath mapping on blk-mq devices
+
+From: Junichi Nomura <j-nomura@ce.jp.nec.com>
+
+commit 15b94a690470038aa08247eedbebbe7e2218d5ee upstream.
+
+dm-multipath accepts 0 path mapping.
+
+ # echo '0 2097152 multipath 0 0 0 0' | dmsetup create newdev
+
+Such a mapping can be used to release underlying devices while still
+holding requests in its queue until working paths come back.
+
+However, once the multipath device is created over blk-mq devices,
+it rejects reloading of 0 path mapping:
+
+ # echo '0 2097152 multipath 0 0 1 1 queue-length 0 1 1 /dev/sda 1' \
+ | dmsetup create mpath1
+ # echo '0 2097152 multipath 0 0 0 0' | dmsetup load mpath1
+ device-mapper: reload ioctl on mpath1 failed: Invalid argument
+ Command failed
+
+With following kernel message:
+ device-mapper: ioctl: can't change device type after initial table load.
+
+DM tries to inherit the current table type using dm_table_set_type()
+but it doesn't work as expected because of unnecessary check about
+whether the target type is hybrid or not.
+
+Hybrid type is for targets that work as either request-based or bio-based
+and not required for blk-mq or non blk-mq checking.
+
+Fixes: 65803c205983 ("dm table: train hybrid target type detection to select blk-mq if appropriate")
+Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-table.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -823,6 +823,12 @@ void dm_consume_args(struct dm_arg_set *
+ }
+ EXPORT_SYMBOL(dm_consume_args);
+
++static bool __table_type_request_based(unsigned table_type)
++{
++ return (table_type == DM_TYPE_REQUEST_BASED ||
++ table_type == DM_TYPE_MQ_REQUEST_BASED);
++}
++
+ static int dm_table_set_type(struct dm_table *t)
+ {
+ unsigned i;
+@@ -855,8 +861,7 @@ static int dm_table_set_type(struct dm_t
+ * Determine the type from the live device.
+ * Default to bio-based if device is new.
+ */
+- if (live_md_type == DM_TYPE_REQUEST_BASED ||
+- live_md_type == DM_TYPE_MQ_REQUEST_BASED)
++ if (__table_type_request_based(live_md_type))
+ request_based = 1;
+ else
+ bio_based = 1;
+@@ -906,7 +911,7 @@ static int dm_table_set_type(struct dm_t
+ }
+ t->type = DM_TYPE_MQ_REQUEST_BASED;
+
+- } else if (hybrid && list_empty(devices) && live_md_type != DM_TYPE_NONE) {
++ } else if (list_empty(devices) && __table_type_request_based(live_md_type)) {
+ /* inherit live MD type */
+ t->type = live_md_type;
+
+@@ -928,10 +933,7 @@ struct target_type *dm_table_get_immutab
+
+ bool dm_table_request_based(struct dm_table *t)
+ {
+- unsigned table_type = dm_table_get_type(t);
+-
+- return (table_type == DM_TYPE_REQUEST_BASED ||
+- table_type == DM_TYPE_MQ_REQUEST_BASED);
++ return __table_type_request_based(dm_table_get_type(t));
+ }
+
+ bool dm_table_mq_request_based(struct dm_table *t)
--- /dev/null
+From 42e08c78360e58516b6ac8af18a75a494f2967a2 Mon Sep 17 00:00:00 2001
+From: Oded Gabbay <oded.gabbay@gmail.com>
+Date: Tue, 5 May 2015 11:15:07 +0300
+Subject: drm/amdkfd: Don't report local memory size
+
+From: Oded Gabbay <oded.gabbay@gmail.com>
+
+commit 42e08c78360e58516b6ac8af18a75a494f2967a2 upstream.
+
+This patch sets the local memory size that is reported to userspace to 0.
+This is done to make sure that userspace won't try to allocate local memory
+for HSA.
+
+As long as amdkfd doesn't support allocating local memory for HSA,
+we need this patch.
+
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+@@ -729,7 +729,7 @@ static ssize_t node_show(struct kobject
+ kfd2kgd->get_max_engine_clock_in_mhz(
+ dev->gpu->kgd));
+ sysfs_show_64bit_prop(buffer, "local_mem_size",
+- kfd2kgd->get_vmem_size(dev->gpu->kgd));
++ (unsigned long long int) 0);
+
+ sysfs_show_32bit_prop(buffer, "fw_version",
+ kfd2kgd->get_fw_version(
--- /dev/null
+From 2e7f43c41c042d6fed4d67aceeaae32d8f102e98 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed, 20 May 2015 10:36:32 +0200
+Subject: drm/plane-helper: Adapt cursor hack to transitional helpers
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 2e7f43c41c042d6fed4d67aceeaae32d8f102e98 upstream.
+
+In
+
+commit f02ad907cd9e7fe3a6405d2d005840912f1ed258
+Author: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Thu Jan 22 16:36:23 2015 +0100
+
+ drm/atomic-helpers: Recover full cursor plane behaviour
+
+we've added a hack to atomic helpers to never to vblank waits for
+cursor updates through the legacy apis since that's what X expects.
+Unfortunately we've (again) forgotten to adjust the transitional
+helpers. Do this now.
+
+This fixes regressions for drivers only partially converted over to
+atomic (like i915).
+
+Reported-by: Pekka Paalanen <ppaalanen@gmail.com>
+Cc: Pekka Paalanen <ppaalanen@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Reviewed-and-tested-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_plane_helper.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/drm_plane_helper.c
++++ b/drivers/gpu/drm/drm_plane_helper.c
+@@ -476,6 +476,9 @@ int drm_plane_helper_commit(struct drm_p
+ if (!crtc[i])
+ continue;
+
++ if (crtc[i]->cursor == plane)
++ continue;
++
+ /* There's no other way to figure out whether the crtc is running. */
+ ret = drm_crtc_vblank_get(crtc[i]);
+ if (ret == 0) {
--- /dev/null
+From fcf3b54282e4c5a95a1f45f67558bc105acdbc6a Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 12 May 2015 12:51:38 -0400
+Subject: drm/radeon: add new bonaire pci id
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit fcf3b54282e4c5a95a1f45f67558bc105acdbc6a upstream.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/drm/drm_pciids.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -186,6 +186,7 @@
+ {0x1002, 0x6658, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x665c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x665d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
++ {0x1002, 0x665f, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BONAIRE|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6660, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6663, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+ {0x1002, 0x6664, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HAINAN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
--- /dev/null
+From fbfd3bc7dfd7efcad2d2e52bf634f84c80a77a35 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 27 May 2015 11:33:26 -0400
+Subject: drm/radeon/audio: make sure connector is valid in hotplug case
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit fbfd3bc7dfd7efcad2d2e52bf634f84c80a77a35 upstream.
+
+Avoids a crash when a monitor is hotplugged and the encoder
+and connector are not linked yet.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=90681
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/evergreen_hdmi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
++++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
+@@ -400,7 +400,7 @@ void evergreen_hdmi_enable(struct drm_en
+ if (enable) {
+ struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+
+- if (drm_detect_monitor_audio(radeon_connector_edid(connector))) {
++ if (connector && drm_detect_monitor_audio(radeon_connector_edid(connector))) {
+ WREG32(HDMI_INFOFRAME_CONTROL0 + dig->afmt->offset,
+ HDMI_AVI_INFO_SEND | /* enable AVI info frames */
+ HDMI_AVI_INFO_CONT | /* required for audio info values to be updated */
+@@ -438,7 +438,8 @@ void evergreen_dp_enable(struct drm_enco
+ if (!dig || !dig->afmt)
+ return;
+
+- if (enable && drm_detect_monitor_audio(radeon_connector_edid(connector))) {
++ if (enable && connector &&
++ drm_detect_monitor_audio(radeon_connector_edid(connector))) {
+ struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+ struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+ struct radeon_connector_atom_dig *dig_connector;
--- /dev/null
+From a10f0df0615abb194968fc08147f3cdd70fd5aa5 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 26 May 2015 18:01:05 -0400
+Subject: drm/radeon: don't share plls if monitors differ in audio support
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a10f0df0615abb194968fc08147f3cdd70fd5aa5 upstream.
+
+Enabling audio may enable different pll dividers. Don't share
+plls if the monitors differ in audio support.
+
+bug:
+https://bugzilla.kernel.org/show_bug.cgi?id=98751
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_crtc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -1789,7 +1789,9 @@ static int radeon_get_shared_nondp_ppll(
+ if ((crtc->mode.clock == test_crtc->mode.clock) &&
+ (adjusted_clock == test_adjusted_clock) &&
+ (radeon_crtc->ss_enabled == test_radeon_crtc->ss_enabled) &&
+- (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID))
++ (test_radeon_crtc->pll_id != ATOM_PPLL_INVALID) &&
++ (drm_detect_monitor_audio(radeon_connector_edid(test_radeon_crtc->connector)) ==
++ drm_detect_monitor_audio(radeon_connector_edid(radeon_crtc->connector))))
+ return test_radeon_crtc->pll_id;
+ }
+ }
--- /dev/null
+From 607d48063512707a414e346972e2210dc71ab491 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Tue, 12 May 2015 14:56:17 +0200
+Subject: drm/radeon: fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit 607d48063512707a414e346972e2210dc71ab491 upstream.
+
+The mapping range is inclusive between starting and ending addresses.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 4 ++--
+ drivers/gpu/drm/radeon/evergreen.c | 2 +-
+ drivers/gpu/drm/radeon/ni.c | 5 +++--
+ drivers/gpu/drm/radeon/r600.c | 2 +-
+ drivers/gpu/drm/radeon/rv770.c | 2 +-
+ drivers/gpu/drm/radeon/si.c | 4 ++--
+ 6 files changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -5789,7 +5789,7 @@ static int cik_pcie_gart_enable(struct r
+ L2_CACHE_BIGK_FRAGMENT_SIZE(4));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+@@ -5804,7 +5804,7 @@ static int cik_pcie_gart_enable(struct r
+ /* restore context1-15 */
+ /* set vm size, must be a multiple of 4 */
+ WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
+- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
+ for (i = 1; i < 16; i++) {
+ if (i < 8)
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2457,7 +2457,7 @@ static int evergreen_pcie_gart_enable(st
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1253,7 +1253,7 @@ static int cayman_pcie_gart_enable(struc
+ L2_CACHE_BIGK_FRAGMENT_SIZE(6));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+@@ -1272,7 +1272,8 @@ static int cayman_pcie_gart_enable(struc
+ */
+ for (i = 1; i < 8; i++) {
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR + (i << 2), 0);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2), rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR + (i << 2),
++ rdev->vm_manager.max_pfn - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
+ rdev->vm_manager.saved_table_addr[i]);
+ }
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -1086,7 +1086,7 @@ static int r600_pcie_gart_enable(struct
+ WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -921,7 +921,7 @@ static int rv770_pcie_gart_enable(struct
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -4273,7 +4273,7 @@ static int si_pcie_gart_enable(struct ra
+ L2_CACHE_BIGK_FRAGMENT_SIZE(4));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+@@ -4288,7 +4288,7 @@ static int si_pcie_gart_enable(struct ra
+ /* empty context1-15 */
+ /* set vm size, must be a multiple of 4 */
+ WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
+- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
+ /* Assign the pt base to something valid for now; the pts used for
+ * the VMs are determined by the application and setup and assigned
+ * on the fly in the vm part of radeon_gart.c
--- /dev/null
+From 7c0411d2fabc2e2702c9871ffb603e251158b317 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 28 May 2015 15:51:59 +0200
+Subject: drm/radeon: partially revert "fix VM_CONTEXT*_PAGE_TABLE_END_ADDR handling"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+
+commit 7c0411d2fabc2e2702c9871ffb603e251158b317 upstream.
+
+We have that bug for years and some users report side effects when fixing it on older hardware.
+
+So revert it for VM_CONTEXT0_PAGE_TABLE_END_ADDR, but keep it for VM 1-15.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/cik.c | 2 +-
+ drivers/gpu/drm/radeon/evergreen.c | 2 +-
+ drivers/gpu/drm/radeon/ni.c | 2 +-
+ drivers/gpu/drm/radeon/r600.c | 2 +-
+ drivers/gpu/drm/radeon/rv770.c | 2 +-
+ drivers/gpu/drm/radeon/si.c | 2 +-
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -5789,7 +5789,7 @@ static int cik_pcie_gart_enable(struct r
+ L2_CACHE_BIGK_FRAGMENT_SIZE(4));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2457,7 +2457,7 @@ static int evergreen_pcie_gart_enable(st
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1253,7 +1253,7 @@ static int cayman_pcie_gart_enable(struc
+ L2_CACHE_BIGK_FRAGMENT_SIZE(6));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -1086,7 +1086,7 @@ static int r600_pcie_gart_enable(struct
+ WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -921,7 +921,7 @@ static int rv770_pcie_gart_enable(struct
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -4273,7 +4273,7 @@ static int si_pcie_gart_enable(struct ra
+ L2_CACHE_BIGK_FRAGMENT_SIZE(4));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
--- /dev/null
+From 0f28d1281b6c54cc98746ae61e44e7f540758ed4 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 18 May 2015 10:38:25 -0400
+Subject: drm/radeon: retry dcpd fetch
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 0f28d1281b6c54cc98746ae61e44e7f540758ed4 upstream.
+
+Retry the dpcd fetch several times. Some eDP panels
+fail several times before the fetch is successful.
+
+bug:
+https://bugs.freedesktop.org/show_bug.cgi?id=73530
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/atombios_dp.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -412,19 +412,21 @@ bool radeon_dp_getdpcd(struct radeon_con
+ {
+ struct radeon_connector_atom_dig *dig_connector = radeon_connector->con_priv;
+ u8 msg[DP_DPCD_SIZE];
+- int ret;
++ int ret, i;
+
+- ret = drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_DPCD_REV, msg,
+- DP_DPCD_SIZE);
+- if (ret > 0) {
+- memcpy(dig_connector->dpcd, msg, DP_DPCD_SIZE);
++ for (i = 0; i < 7; i++) {
++ ret = drm_dp_dpcd_read(&radeon_connector->ddc_bus->aux, DP_DPCD_REV, msg,
++ DP_DPCD_SIZE);
++ if (ret == DP_DPCD_SIZE) {
++ memcpy(dig_connector->dpcd, msg, DP_DPCD_SIZE);
+
+- DRM_DEBUG_KMS("DPCD: %*ph\n", (int)sizeof(dig_connector->dpcd),
+- dig_connector->dpcd);
++ DRM_DEBUG_KMS("DPCD: %*ph\n", (int)sizeof(dig_connector->dpcd),
++ dig_connector->dpcd);
+
+- radeon_dp_probe_oui(radeon_connector);
++ radeon_dp_probe_oui(radeon_connector);
+
+- return true;
++ return true;
++ }
+ }
+ dig_connector->dpcd[0] = 0;
+ return false;
--- /dev/null
+From 2b1d3ae940acd11be44c6eced5873d47c2e00ffa Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Thu, 28 May 2015 15:44:24 -0700
+Subject: fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 2b1d3ae940acd11be44c6eced5873d47c2e00ffa upstream.
+
+load_elf_binary() returns `retval', not `error'.
+
+Fixes: a87938b2e246b81b4fb ("fs/binfmt_elf.c: fix bug in loading of PIE binaries")
+Reported-by: James Hogan <james.hogan@imgtec.com>
+Cc: Michael Davidson <md@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/binfmt_elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -928,7 +928,7 @@ static int load_elf_binary(struct linux_
+ total_size = total_mapping_size(elf_phdata,
+ loc->elf_ex.e_phnum);
+ if (!total_size) {
+- error = -EINVAL;
++ retval = -EINVAL;
+ goto out_free_dentry;
+ }
+ }
--- /dev/null
+From 3c0213d17a09601e0c6c0ae0e27caf70d988290f Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Thu, 23 Apr 2015 09:08:43 -0700
+Subject: Input: elantech - fix semi-mt protocol for v3 HW
+
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+
+commit 3c0213d17a09601e0c6c0ae0e27caf70d988290f upstream.
+
+When the v3 hardware sees more than one finger, it uses the semi-mt
+protocol to report the touches. However, it currently works when
+num_fingers is 0, 1 or 2, but when it is 3 and above, it sends only 1
+finger as if num_fingers was 1.
+
+This confuses userspace which knows how to deal with extra fingers
+when all the slots are used, but not when some are missing.
+
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=90101
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/elantech.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -315,7 +315,7 @@ static void elantech_report_semi_mt_data
+ unsigned int x2, unsigned int y2)
+ {
+ elantech_set_slot(dev, 0, num_fingers != 0, x1, y1);
+- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2);
++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2);
+ }
+
+ /*
--- /dev/null
+From a500e469ead055f35c7b2d0a1104e1bd58e34e70 Mon Sep 17 00:00:00 2001
+From: Luciano Coelho <luciano.coelho@intel.com>
+Date: Mon, 4 May 2015 17:03:17 +0300
+Subject: iwlwifi: mvm: clean net-detect info if device was reset during suspend
+
+From: Luciano Coelho <luciano.coelho@intel.com>
+
+commit a500e469ead055f35c7b2d0a1104e1bd58e34e70 upstream.
+
+If the device is reset during suspend with net-detect enabled, we
+leave the net-detect information dangling and this causes the next
+suspend to fail with a warning:
+
+[21795.351010] WARNING: at /root/iwlwifi/iwlwifi-stack-dev/drivers/net/wireless/iwlwifi/mvm/d3.c:989 __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]()
+[21795.353253] Modules linked in: iwlmvm(O) iwlwifi(O) mac80211(O) cfg80211(O) compat(O) [...]
+[21795.366168] CPU: 1 PID: 3645 Comm: bash Tainted: G O 3.10.29-dev #1
+[21795.368785] Hardware name: Dell Inc. Latitude E6430/0CPWYR, BIOS A09 12/13/2012
+[21795.371441] f8ec6748 f8ec6748 e51f3ce8 c168aa62 e51f3d10 c103a824 c1871238 f8ec6748
+[21795.374228] 000003dd f8eb982e f8eb982e 00000000 c3408ed4 c41edbbc e51f3d20 c103a862
+[21795.377006] 00000009 00000000 e51f3da8 f8eb982e c41ee3dc 00000004 e7970000 e51f3d74
+[21795.379792] Call Trace:
+[21795.382461] [<c168aa62>] dump_stack+0x16/0x18
+[21795.385133] [<c103a824>] warn_slowpath_common+0x64/0x80
+[21795.387803] [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
+[21795.390485] [<f8eb982e>] ? __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
+[21795.393124] [<c103a862>] warn_slowpath_null+0x22/0x30
+[21795.395787] [<f8eb982e>] __iwl_mvm_suspend.isra.6+0x2be/0x460 [iwlmvm]
+[21795.398464] [<f8eb9d7c>] iwl_mvm_suspend+0xec/0x140 [iwlmvm]
+[21795.401127] [<c104be11>] ? del_timer_sync+0xa1/0xc0
+[21795.403800] [<f8d4107e>] __ieee80211_suspend+0x1de/0xff0 [mac80211]
+[21795.406459] [<c168e43d>] ? mutex_lock_nested+0x25d/0x350
+[21795.409084] [<c1586b64>] ? rtnl_lock+0x14/0x20
+[21795.411685] [<f8cf0076>] ieee80211_suspend+0x16/0x20 [mac80211]
+[21795.414318] [<f8c4e014>] wiphy_suspend+0x74/0x710 [cfg80211]
+[21795.416916] [<c141e612>] __device_suspend+0x1e2/0x220
+[21795.419521] [<f8c4dfa0>] ? addresses_show+0xa0/0xa0 [cfg80211]
+[21795.422097] [<c141f997>] dpm_suspend+0x67/0x210
+[21795.424661] [<c141fd6f>] dpm_suspend_start+0x4f/0x60
+[21795.427219] [<c108d8e0>] suspend_devices_and_enter+0x60/0x480
+[21795.429768] [<c168646a>] ? printk+0x4d/0x4f
+[21795.432295] [<c108de76>] pm_suspend+0x176/0x210
+[21795.434830] [<c108ca5d>] state_store+0x5d/0xb0
+[21795.437410] [<c108ca00>] ? wakeup_count_show+0x50/0x50
+[21795.439961] [<c13208db>] kobj_attr_store+0x1b/0x30
+[21795.442514] [<c11e3a4b>] sysfs_write_file+0xab/0x100
+[21795.445088] [<c11e39a0>] ? sysfs_poll+0xa0/0xa0
+[21795.447659] [<c1179655>] vfs_write+0xa5/0x1c0
+[21795.450212] [<c1179af7>] SyS_write+0x57/0xa0
+[21795.452699] [<c1699ec1>] sysenter_do_call+0x12/0x32
+[21795.455146] ---[ end trace faf5321baba2bfdb ]---
+
+To fix this, call the iwl_mvm_free_nd() function in case of any error
+during resume. Additionally, rename the "out_unlock" label to err to
+make it clearer that it's only called in error conditions.
+
+Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/d3.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
+@@ -1860,15 +1860,15 @@ static int __iwl_mvm_resume(struct iwl_m
+ /* get the BSS vif pointer again */
+ vif = iwl_mvm_get_bss_vif(mvm);
+ if (IS_ERR_OR_NULL(vif))
+- goto out_unlock;
++ goto err;
+
+ ret = iwl_trans_d3_resume(mvm->trans, &d3_status, test);
+ if (ret)
+- goto out_unlock;
++ goto err;
+
+ if (d3_status != IWL_D3_STATUS_ALIVE) {
+ IWL_INFO(mvm, "Device was reset during suspend\n");
+- goto out_unlock;
++ goto err;
+ }
+
+ /* query SRAM first in case we want event logging */
+@@ -1886,7 +1886,8 @@ static int __iwl_mvm_resume(struct iwl_m
+ /* has unlocked the mutex, so skip that */
+ goto out;
+
+- out_unlock:
++err:
++ iwl_mvm_free_nd(mvm);
+ mutex_unlock(&mvm->mutex);
+
+ out:
--- /dev/null
+From 2fc863a5143d64b8f06576cc3d7fd5622c5cf3b5 Mon Sep 17 00:00:00 2001
+From: Haim Dreyfuss <haim.dreyfuss@intel.com>
+Date: Wed, 20 May 2015 08:10:43 +0300
+Subject: iwlwifi: mvm: Free fw_status after use to avoid memory leak
+
+From: Haim Dreyfuss <haim.dreyfuss@intel.com>
+
+commit 2fc863a5143d64b8f06576cc3d7fd5622c5cf3b5 upstream.
+
+fw_status is the only pointer pointing to a block of memory
+allocated above and should be freed after use.
+Note: this come from Klockwork static analyzer.
+
+Fixes: 2021a89d7b8a ("iwlwifi: mvm: treat netdetect wake up separately")
+Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/d3.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
++++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
+@@ -1742,8 +1742,10 @@ static void iwl_mvm_query_netdetect_reas
+ int i, j, n_matches, ret;
+
+ fw_status = iwl_mvm_get_wakeup_status(mvm, vif);
+- if (!IS_ERR_OR_NULL(fw_status))
++ if (!IS_ERR_OR_NULL(fw_status)) {
+ reasons = le32_to_cpu(fw_status->wakeup_reasons);
++ kfree(fw_status);
++ }
+
+ if (reasons & IWL_WOWLAN_WAKEUP_BY_RFKILL_DEASSERTED)
+ wakeup.rfkill_release = true;
--- /dev/null
+From 553452e5ffc0ed13214a287549627d02d9d7fbdc Mon Sep 17 00:00:00 2001
+From: Liad Kaufman <liad.kaufman@intel.com>
+Date: Thu, 16 Apr 2015 17:21:12 +0300
+Subject: iwlwifi: pcie: prevent using unmapped memory in fw monitor
+
+From: Liad Kaufman <liad.kaufman@intel.com>
+
+commit 553452e5ffc0ed13214a287549627d02d9d7fbdc upstream.
+
+In the case of a DMA mapping error on the last iteration of
+the loop of the allocation of memory of the FW monitor we
+indeed free the pages, but don't NULL out the page variable
+thus allowing for the possibility of setting the FW monitor
+variables with invalid data to use.
+
+Fixes: c2d202017da1 ("iwlwifi: pcie: add firmware monitor capabilities")
+Signed-off-by: Liad Kaufman <liad.kaufman@intel.com>
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/pcie/trans.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -5,8 +5,8 @@
+ *
+ * GPL LICENSE SUMMARY
+ *
+- * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
+- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
++ * Copyright(c) 2007 - 2015 Intel Corporation. All rights reserved.
++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -31,8 +31,8 @@
+ *
+ * BSD LICENSE
+ *
+- * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
++ * Copyright(c) 2005 - 2015 Intel Corporation. All rights reserved.
++ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -104,7 +104,7 @@ static void iwl_pcie_free_fw_monitor(str
+ static void iwl_pcie_alloc_fw_monitor(struct iwl_trans *trans)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+- struct page *page;
++ struct page *page = NULL;
+ dma_addr_t phys;
+ u32 size;
+ u8 power;
+@@ -131,6 +131,7 @@ static void iwl_pcie_alloc_fw_monitor(st
+ DMA_FROM_DEVICE);
+ if (dma_mapping_error(trans->dev, phys)) {
+ __free_pages(page, order);
++ page = NULL;
+ continue;
+ }
+ IWL_INFO(trans,
--- /dev/null
+From 56ccc1125bc141cf63927eda7febff4216dea2d3 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Thu, 28 May 2015 17:53:29 +1000
+Subject: md: fix race when unfreezing sync_action
+
+From: NeilBrown <neilb@suse.de>
+
+commit 56ccc1125bc141cf63927eda7febff4216dea2d3 upstream.
+
+A recent change removed the need for locking around writing
+to "sync_action" (and various other places), but introduced a
+subtle race.
+When e.g. setting 'reshape' on a 'frozen' array, the 'frozen'
+flag is cleared before 'reshape' is set, so the md thread can
+get in and start trying recovery - which isn't wanted.
+
+So instead of clearing MD_RECOVERY_FROZEN for any command
+except 'frozen', only clear it when each specific command
+is parsed. This allows the handling of 'reshape' to clear
+the bit while a lock is held.
+
+Also remove some places where we set MD_RECOVERY_NEEDED,
+as it is always set on non-error exit of the function.
+
+
+Signed-off-by: NeilBrown <neilb@suse.de>
+Fixes: 6791875e2e53 ("md: make reconfig_mutex optional for writes to md sysfs files.")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -4138,12 +4138,12 @@ action_store(struct mddev *mddev, const
+ if (!mddev->pers || !mddev->pers->sync_request)
+ return -EINVAL;
+
+- if (cmd_match(page, "frozen"))
+- set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+- else
+- clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+
+ if (cmd_match(page, "idle") || cmd_match(page, "frozen")) {
++ if (cmd_match(page, "frozen"))
++ set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
++ else
++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+ flush_workqueue(md_misc_wq);
+ if (mddev->sync_thread) {
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+@@ -4156,16 +4156,17 @@ action_store(struct mddev *mddev, const
+ test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
+ return -EBUSY;
+ else if (cmd_match(page, "resync"))
+- set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+ else if (cmd_match(page, "recover")) {
++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+ set_bit(MD_RECOVERY_RECOVER, &mddev->recovery);
+- set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+ } else if (cmd_match(page, "reshape")) {
+ int err;
+ if (mddev->pers->start_reshape == NULL)
+ return -EINVAL;
+ err = mddev_lock(mddev);
+ if (!err) {
++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+ err = mddev->pers->start_reshape(mddev);
+ mddev_unlock(mddev);
+ }
+@@ -4177,6 +4178,7 @@ action_store(struct mddev *mddev, const
+ set_bit(MD_RECOVERY_CHECK, &mddev->recovery);
+ else if (!cmd_match(page, "repair"))
+ return -EINVAL;
++ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+ set_bit(MD_RECOVERY_REQUESTED, &mddev->recovery);
+ set_bit(MD_RECOVERY_SYNC, &mddev->recovery);
+ }
--- /dev/null
+From 620b155034570f577470cf5309f741bac6a6e32b Mon Sep 17 00:00:00 2001
+From: Paul Burton <paul.burton@imgtec.com>
+Date: Wed, 6 May 2015 11:52:32 +0100
+Subject: MIPS: fix FP mode selection in lieu of .MIPS.abiflags data
+
+From: Paul Burton <paul.burton@imgtec.com>
+
+commit 620b155034570f577470cf5309f741bac6a6e32b upstream.
+
+Commit 46490b572544 ("MIPS: kernel: elf: Improve the overall ABI and FPU
+mode checks") reworked the ELF FP ABI mode selection logic, but when
+CONFIG_MIPS_O32_FP64_SUPPORT is enabled it breaks the use of binaries
+which have no PT_MIPS_ABIFLAGS program header & associated
+.MIPS.abiflags section.
+
+A default mode is selected based upon whether the ELF contains MIPS32 or
+MIPS64 code, but that selection is made in arch_elf_pt_proc.
+arch_elf_pt_proc only executes when a PT_MIPS_ABIFLAGS program header is
+found. If one is not found then arch_elf_pt_proc is never called, and no
+default overall_fp_mode value is selected. When arch_check_elf is
+called, both abi0 & abi1 are MIPS_ABI_FP_UNKNOWN which leads to both
+prog_req & interp_req being set to none_req. none_req matches none of
+the conditions for mode selection at the end of arch_check_elf, so
+overall_fp_mode is left untouched. Finally once mips_set_personality_fp
+is called the BUG() in the default case is then hit & the kernel likely
+panics.
+
+Fix this by moving the selection of a default overall mode to the start
+of arch_check_elf, which runs once per ELF executed regardless of
+whether it has a PT_MIPS_ABIFLAGS program header.
+
+Signed-off-by: Paul Burton <paul.burton@imgtec.com>
+Cc: Markos Chandras <markos.chandras@imgtec.com>
+Cc: Matthew Fortune <matthew.fortune@imgtec.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Patchwork: http://patchwork.linux-mips.org/patch/9978/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/elf.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+--- a/arch/mips/kernel/elf.c
++++ b/arch/mips/kernel/elf.c
+@@ -76,14 +76,6 @@ int arch_elf_pt_proc(void *_ehdr, void *
+
+ /* Lets see if this is an O32 ELF */
+ if (ehdr32->e_ident[EI_CLASS] == ELFCLASS32) {
+- /* FR = 1 for N32 */
+- if (ehdr32->e_flags & EF_MIPS_ABI2)
+- state->overall_fp_mode = FP_FR1;
+- else
+- /* Set a good default FPU mode for O32 */
+- state->overall_fp_mode = cpu_has_mips_r6 ?
+- FP_FRE : FP_FR0;
+-
+ if (ehdr32->e_flags & EF_MIPS_FP64) {
+ /*
+ * Set MIPS_ABI_FP_OLD_64 for EF_MIPS_FP64. We will override it
+@@ -104,9 +96,6 @@ int arch_elf_pt_proc(void *_ehdr, void *
+ (char *)&abiflags,
+ sizeof(abiflags));
+ } else {
+- /* FR=1 is really the only option for 64-bit */
+- state->overall_fp_mode = FP_FR1;
+-
+ if (phdr64->p_type != PT_MIPS_ABIFLAGS)
+ return 0;
+ if (phdr64->p_filesz < sizeof(abiflags))
+@@ -147,6 +136,7 @@ int arch_check_elf(void *_ehdr, bool has
+ struct elf32_hdr *ehdr = _ehdr;
+ struct mode_req prog_req, interp_req;
+ int fp_abi, interp_fp_abi, abi0, abi1, max_abi;
++ bool is_mips64;
+
+ if (!config_enabled(CONFIG_MIPS_O32_FP64_SUPPORT))
+ return 0;
+@@ -162,10 +152,22 @@ int arch_check_elf(void *_ehdr, bool has
+ abi0 = abi1 = fp_abi;
+ }
+
+- /* ABI limits. O32 = FP_64A, N32/N64 = FP_SOFT */
+- max_abi = ((ehdr->e_ident[EI_CLASS] == ELFCLASS32) &&
+- (!(ehdr->e_flags & EF_MIPS_ABI2))) ?
+- MIPS_ABI_FP_64A : MIPS_ABI_FP_SOFT;
++ is_mips64 = (ehdr->e_ident[EI_CLASS] == ELFCLASS64) ||
++ (ehdr->e_flags & EF_MIPS_ABI2);
++
++ if (is_mips64) {
++ /* MIPS64 code always uses FR=1, thus the default is easy */
++ state->overall_fp_mode = FP_FR1;
++
++ /* Disallow access to the various FPXX & FP64 ABIs */
++ max_abi = MIPS_ABI_FP_SOFT;
++ } else {
++ /* Default to a mode capable of running code expecting FR=0 */
++ state->overall_fp_mode = cpu_has_mips_r6 ? FP_FRE : FP_FR0;
++
++ /* Allow all ABIs we know about */
++ max_abi = MIPS_ABI_FP_64A;
++ }
+
+ if ((abi0 > max_abi && abi0 != MIPS_ABI_FP_UNKNOWN) ||
+ (abi1 > max_abi && abi1 != MIPS_ABI_FP_UNKNOWN))
--- /dev/null
+From 932df43005389300a3336421e4aedb25390ae144 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Date: Thu, 16 Apr 2015 20:19:43 +0800
+Subject: power/reset: at91: fix return value check in at91_reset_platform_probe()
+
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+
+commit 932df43005389300a3336421e4aedb25390ae144 upstream.
+
+In case of error, the function devm_ioremap() returns NULL
+not ERR_PTR(). The IS_ERR() test in the return value check
+should be replaced with NULL test.
+
+Fixes: ecfe64d8c55f ("power: reset: Add AT91 reset driver")
+Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/reset/at91-reset.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/power/reset/at91-reset.c
++++ b/drivers/power/reset/at91-reset.c
+@@ -212,9 +212,9 @@ static int at91_reset_platform_probe(str
+ res = platform_get_resource(pdev, IORESOURCE_MEM, idx + 1 );
+ at91_ramc_base[idx] = devm_ioremap(&pdev->dev, res->start,
+ resource_size(res));
+- if (IS_ERR(at91_ramc_base[idx])) {
++ if (!at91_ramc_base[idx]) {
+ dev_err(&pdev->dev, "Could not map ram controller address\n");
+- return PTR_ERR(at91_ramc_base[idx]);
++ return -ENOMEM;
+ }
+ }
+
--- /dev/null
+From 1e70897d0e20f988abedcf73b33684ecd2be9511 Mon Sep 17 00:00:00 2001
+From: Naidu Tellapati <naidu.tellapati@imgtec.com>
+Date: Fri, 8 May 2015 18:47:31 -0300
+Subject: pwm: img: Impose upper and lower timebase steps value
+
+From: Naidu Tellapati <naidu.tellapati@imgtec.com>
+
+commit 1e70897d0e20f988abedcf73b33684ecd2be9511 upstream.
+
+The PWM hardware on Pistachio platform has a maximum timebase steps
+value to 255. To fix it, let's introduce a compatible-specific
+data structure to contain the SoC-specific details and use it to
+specify a maximum timebase.
+
+Also, let's limit the minimum timebase to 16 steps, to allow a sane
+range of duty cycle steps.
+
+Fixes: 277bb6a29e00 ("pwm: Imagination Technologies PWM DAC driver")
+Signed-off-by: Naidu Tellapati <naidu.tellapati@imgtec.com>
+Signed-off-by: Ezequiel Garcia <ezequiel.garcia@imgtec.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pwm/pwm-img.c | 76 ++++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 64 insertions(+), 12 deletions(-)
+
+--- a/drivers/pwm/pwm-img.c
++++ b/drivers/pwm/pwm-img.c
+@@ -16,6 +16,7 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
++#include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/pwm.h>
+ #include <linux/regmap.h>
+@@ -38,7 +39,22 @@
+ #define PERIP_PWM_PDM_CONTROL_CH_MASK 0x1
+ #define PERIP_PWM_PDM_CONTROL_CH_SHIFT(ch) ((ch) * 4)
+
+-#define MAX_TMBASE_STEPS 65536
++/*
++ * PWM period is specified with a timebase register,
++ * in number of step periods. The PWM duty cycle is also
++ * specified in step periods, in the [0, $timebase] range.
++ * In other words, the timebase imposes the duty cycle
++ * resolution. Therefore, let's constraint the timebase to
++ * a minimum value to allow a sane range of duty cycle values.
++ * Imposing a minimum timebase, will impose a maximum PWM frequency.
++ *
++ * The value chosen is completely arbitrary.
++ */
++#define MIN_TMBASE_STEPS 16
++
++struct img_pwm_soc_data {
++ u32 max_timebase;
++};
+
+ struct img_pwm_chip {
+ struct device *dev;
+@@ -47,6 +63,9 @@ struct img_pwm_chip {
+ struct clk *sys_clk;
+ void __iomem *base;
+ struct regmap *periph_regs;
++ int max_period_ns;
++ int min_period_ns;
++ const struct img_pwm_soc_data *data;
+ };
+
+ static inline struct img_pwm_chip *to_img_pwm_chip(struct pwm_chip *chip)
+@@ -72,24 +91,31 @@ static int img_pwm_config(struct pwm_chi
+ u32 val, div, duty, timebase;
+ unsigned long mul, output_clk_hz, input_clk_hz;
+ struct img_pwm_chip *pwm_chip = to_img_pwm_chip(chip);
++ unsigned int max_timebase = pwm_chip->data->max_timebase;
++
++ if (period_ns < pwm_chip->min_period_ns ||
++ period_ns > pwm_chip->max_period_ns) {
++ dev_err(chip->dev, "configured period not in range\n");
++ return -ERANGE;
++ }
+
+ input_clk_hz = clk_get_rate(pwm_chip->pwm_clk);
+ output_clk_hz = DIV_ROUND_UP(NSEC_PER_SEC, period_ns);
+
+ mul = DIV_ROUND_UP(input_clk_hz, output_clk_hz);
+- if (mul <= MAX_TMBASE_STEPS) {
++ if (mul <= max_timebase) {
+ div = PWM_CTRL_CFG_NO_SUB_DIV;
+ timebase = DIV_ROUND_UP(mul, 1);
+- } else if (mul <= MAX_TMBASE_STEPS * 8) {
++ } else if (mul <= max_timebase * 8) {
+ div = PWM_CTRL_CFG_SUB_DIV0;
+ timebase = DIV_ROUND_UP(mul, 8);
+- } else if (mul <= MAX_TMBASE_STEPS * 64) {
++ } else if (mul <= max_timebase * 64) {
+ div = PWM_CTRL_CFG_SUB_DIV1;
+ timebase = DIV_ROUND_UP(mul, 64);
+- } else if (mul <= MAX_TMBASE_STEPS * 512) {
++ } else if (mul <= max_timebase * 512) {
+ div = PWM_CTRL_CFG_SUB_DIV0_DIV1;
+ timebase = DIV_ROUND_UP(mul, 512);
+- } else if (mul > MAX_TMBASE_STEPS * 512) {
++ } else if (mul > max_timebase * 512) {
+ dev_err(chip->dev,
+ "failed to configure timebase steps/divider value\n");
+ return -EINVAL;
+@@ -143,11 +169,27 @@ static const struct pwm_ops img_pwm_ops
+ .owner = THIS_MODULE,
+ };
+
++static const struct img_pwm_soc_data pistachio_pwm = {
++ .max_timebase = 255,
++};
++
++static const struct of_device_id img_pwm_of_match[] = {
++ {
++ .compatible = "img,pistachio-pwm",
++ .data = &pistachio_pwm,
++ },
++ { }
++};
++MODULE_DEVICE_TABLE(of, img_pwm_of_match);
++
+ static int img_pwm_probe(struct platform_device *pdev)
+ {
+ int ret;
++ u64 val;
++ unsigned long clk_rate;
+ struct resource *res;
+ struct img_pwm_chip *pwm;
++ const struct of_device_id *of_dev_id;
+
+ pwm = devm_kzalloc(&pdev->dev, sizeof(*pwm), GFP_KERNEL);
+ if (!pwm)
+@@ -160,6 +202,11 @@ static int img_pwm_probe(struct platform
+ if (IS_ERR(pwm->base))
+ return PTR_ERR(pwm->base);
+
++ of_dev_id = of_match_device(img_pwm_of_match, &pdev->dev);
++ if (!of_dev_id)
++ return -ENODEV;
++ pwm->data = of_dev_id->data;
++
+ pwm->periph_regs = syscon_regmap_lookup_by_phandle(pdev->dev.of_node,
+ "img,cr-periph");
+ if (IS_ERR(pwm->periph_regs))
+@@ -189,6 +236,17 @@ static int img_pwm_probe(struct platform
+ goto disable_sysclk;
+ }
+
++ clk_rate = clk_get_rate(pwm->pwm_clk);
++
++ /* The maximum input clock divider is 512 */
++ val = (u64)NSEC_PER_SEC * 512 * pwm->data->max_timebase;
++ do_div(val, clk_rate);
++ pwm->max_period_ns = val;
++
++ val = (u64)NSEC_PER_SEC * MIN_TMBASE_STEPS;
++ do_div(val, clk_rate);
++ pwm->min_period_ns = val;
++
+ pwm->chip.dev = &pdev->dev;
+ pwm->chip.ops = &img_pwm_ops;
+ pwm->chip.base = -1;
+@@ -228,12 +286,6 @@ static int img_pwm_remove(struct platfor
+ return pwmchip_remove(&pwm_chip->chip);
+ }
+
+-static const struct of_device_id img_pwm_of_match[] = {
+- { .compatible = "img,pistachio-pwm", },
+- { }
+-};
+-MODULE_DEVICE_TABLE(of, img_pwm_of_match);
+-
+ static struct platform_driver img_pwm_driver = {
+ .driver = {
+ .name = "img-pwm",
--- /dev/null
+From 2d1c18bba15daf89d75ce475ecd2068f483aa12f Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 27 May 2015 11:43:53 -0400
+Subject: Revert "drm/radeon: only mark audio as connected if the monitor supports it (v3)"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 2d1c18bba15daf89d75ce475ecd2068f483aa12f upstream.
+
+This breaks too many things.
+
+bugs:
+https://bugzilla.kernel.org/show_bug.cgi?id=99041
+https://bugs.freedesktop.org/show_bug.cgi?id=90681
+
+This reverts commit 0f55db36d49d45b80eff0c0a2a498766016f458b.
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_audio.c | 27 ++++++++++++---------------
+ drivers/gpu/drm/radeon/radeon_connectors.c | 8 ++------
+ 2 files changed, 14 insertions(+), 21 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_audio.c
++++ b/drivers/gpu/drm/radeon/radeon_audio.c
+@@ -460,9 +460,6 @@ void radeon_audio_detect(struct drm_conn
+ if (!connector || !connector->encoder)
+ return;
+
+- if (!radeon_encoder_is_digital(connector->encoder))
+- return;
+-
+ rdev = connector->encoder->dev->dev_private;
+
+ if (!radeon_audio_chipset_supported(rdev))
+@@ -471,26 +468,26 @@ void radeon_audio_detect(struct drm_conn
+ radeon_encoder = to_radeon_encoder(connector->encoder);
+ dig = radeon_encoder->enc_priv;
+
+- if (!dig->afmt)
+- return;
+-
+ if (status == connector_status_connected) {
+- struct radeon_connector *radeon_connector = to_radeon_connector(connector);
++ struct radeon_connector *radeon_connector;
++ int sink_type;
++
++ if (!drm_detect_monitor_audio(radeon_connector_edid(connector))) {
++ radeon_encoder->audio = NULL;
++ return;
++ }
++
++ radeon_connector = to_radeon_connector(connector);
++ sink_type = radeon_dp_getsinktype(radeon_connector);
+
+ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort &&
+- radeon_dp_getsinktype(radeon_connector) ==
+- CONNECTOR_OBJECT_ID_DISPLAYPORT)
++ sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT)
+ radeon_encoder->audio = rdev->audio.dp_funcs;
+ else
+ radeon_encoder->audio = rdev->audio.hdmi_funcs;
+
+ dig->afmt->pin = radeon_audio_get_pin(connector->encoder);
+- if (drm_detect_monitor_audio(radeon_connector_edid(connector))) {
+- radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
+- } else {
+- radeon_audio_enable(rdev, dig->afmt->pin, 0);
+- dig->afmt->pin = NULL;
+- }
++ radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
+ } else {
+ radeon_audio_enable(rdev, dig->afmt->pin, 0);
+ dig->afmt->pin = NULL;
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -1333,10 +1333,8 @@ out:
+ /* updated in get modes as well since we need to know if it's analog or digital */
+ radeon_connector_update_scratch_regs(connector, ret);
+
+- if (radeon_audio != 0) {
+- radeon_connector_get_edid(connector);
++ if (radeon_audio != 0)
+ radeon_audio_detect(connector, ret);
+- }
+
+ exit:
+ pm_runtime_mark_last_busy(connector->dev->dev);
+@@ -1661,10 +1659,8 @@ radeon_dp_detect(struct drm_connector *c
+
+ radeon_connector_update_scratch_regs(connector, ret);
+
+- if (radeon_audio != 0) {
+- radeon_connector_get_edid(connector);
++ if (radeon_audio != 0)
+ radeon_audio_detect(connector, ret);
+- }
+
+ out:
+ pm_runtime_mark_last_busy(connector->dev->dev);
--- /dev/null
+From 414b7e3b9ce8b0577f613e656fdbc36b34b444dd Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Fri, 24 Apr 2015 11:03:37 -0500
+Subject: rtlwifi: rtl8192cu: Fix kernel deadlock
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+commit 414b7e3b9ce8b0577f613e656fdbc36b34b444dd upstream.
+
+The USB mini-driver in rtlwifi, which is used by rtl8192cu, issues a call to
+usb_control_msg() with a timeout value of 0. In some instances where the
+interface is shutting down, this infinite wait results in a CPU deadlock. A
+one second timeout fixes this problem without affecting any normal operations.
+
+This bug is reported at https://bugzilla.novell.com/show_bug.cgi?id=927786.
+
+Reported-by: Bernhard Wiedemann <bwiedemann@suse.com>
+Tested-by: Bernhard Wiedemann <bwiedemann@suse.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: Bernhard Wiedemann <bwiedemann@suse.com>
+Cc: Takashi Iwai<tiwai@suse.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -126,7 +126,7 @@ static int _usbctrl_vendorreq_sync_read(
+
+ do {
+ status = usb_control_msg(udev, pipe, request, reqtype, value,
+- index, pdata, len, 0); /*max. timeout*/
++ index, pdata, len, 1000);
+ if (status < 0) {
+ /* firmware download is checksumed, don't retry */
+ if ((value >= FW_8192C_START_ADDRESS &&
--- /dev/null
+From 74856fbf441929918c49ff262ace9835048e4e6a Mon Sep 17 00:00:00 2001
+From: Mark Hounschell <dmarkh@cfl.rr.com>
+Date: Wed, 13 May 2015 10:49:09 +0200
+Subject: sd: Disable support for 256 byte/sector disks
+
+From: Mark Hounschell <dmarkh@cfl.rr.com>
+
+commit 74856fbf441929918c49ff262ace9835048e4e6a upstream.
+
+256 bytes per sector support has been broken since 2.6.X,
+and no-one stepped up to fix this.
+So disable support for it.
+
+Signed-off-by: Mark Hounschell <dmarkh@cfl.rr.com>
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sd.c | 19 +++++--------------
+ 1 file changed, 5 insertions(+), 14 deletions(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1624,6 +1624,7 @@ static unsigned int sd_completed_bytes(s
+ {
+ u64 start_lba = blk_rq_pos(scmd->request);
+ u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
++ u64 factor = scmd->device->sector_size / 512;
+ u64 bad_lba;
+ int info_valid;
+ /*
+@@ -1645,16 +1646,9 @@ static unsigned int sd_completed_bytes(s
+ if (scsi_bufflen(scmd) <= scmd->device->sector_size)
+ return 0;
+
+- if (scmd->device->sector_size < 512) {
+- /* only legitimate sector_size here is 256 */
+- start_lba <<= 1;
+- end_lba <<= 1;
+- } else {
+- /* be careful ... don't want any overflows */
+- unsigned int factor = scmd->device->sector_size / 512;
+- do_div(start_lba, factor);
+- do_div(end_lba, factor);
+- }
++ /* be careful ... don't want any overflows */
++ do_div(start_lba, factor);
++ do_div(end_lba, factor);
+
+ /* The bad lba was reported incorrectly, we have no idea where
+ * the error is.
+@@ -2212,8 +2206,7 @@ got_data:
+ if (sector_size != 512 &&
+ sector_size != 1024 &&
+ sector_size != 2048 &&
+- sector_size != 4096 &&
+- sector_size != 256) {
++ sector_size != 4096) {
+ sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
+ sector_size);
+ /*
+@@ -2268,8 +2261,6 @@ got_data:
+ sdkp->capacity <<= 2;
+ else if (sector_size == 1024)
+ sdkp->capacity <<= 1;
+- else if (sector_size == 256)
+- sdkp->capacity >>= 1;
+
+ blk_queue_physical_block_size(sdp->request_queue,
+ sdkp->physical_block_size);
md-raid5-don-t-record-new-size-if-resize_stripes-fails.patch
md-raid0-fix-restore-to-sector-variable-in-raid0_make_request.patch
revert-hid-logitech-hidpp-support-combo-keyboard-touchpad-tk820.patch
+mips-fix-fp-mode-selection-in-lieu-of-.mips.abiflags-data.patch
+rtlwifi-rtl8192cu-fix-kernel-deadlock.patch
+input-elantech-fix-semi-mt-protocol-for-v3-hw.patch
+storvsc-set-the-srb-flags-correctly-when-no-data-transfer-is-needed.patch
+sd-disable-support-for-256-byte-sector-disks.patch
+acpi-init-fix-the-ordering-of-acpi_reserve_resources.patch
+iwlwifi-mvm-clean-net-detect-info-if-device-was-reset-during-suspend.patch
+iwlwifi-mvm-free-fw_status-after-use-to-avoid-memory-leak.patch
+iwlwifi-pcie-prevent-using-unmapped-memory-in-fw-monitor.patch
+drm-radeon-add-new-bonaire-pci-id.patch
+drm-radeon-fix-vm_context-_page_table_end_addr-handling.patch
+drm-radeon-retry-dcpd-fetch.patch
+drm-plane-helper-adapt-cursor-hack-to-transitional-helpers.patch
+drm-radeon-don-t-share-plls-if-monitors-differ-in-audio-support.patch
+drm-radeon-audio-make-sure-connector-is-valid-in-hotplug-case.patch
+revert-drm-radeon-only-mark-audio-as-connected-if-the-monitor-supports-it-v3.patch
+drm-radeon-partially-revert-fix-vm_context-_page_table_end_addr-handling.patch
+dm-fix-casting-bug-in-dm_merge_bvec.patch
+dm-fix-reload-failure-of-0-path-multipath-mapping-on-blk-mq-devices.patch
+drm-amdkfd-don-t-report-local-memory-size.patch
+vfs-read-file_handle-only-once-in-handle_to_path.patch
+power-reset-at91-fix-return-value-check-in-at91_reset_platform_probe.patch
+arc-unbork-llsc-build.patch
+ubi-block-add-missing-cache-flushes.patch
+pwm-img-impose-upper-and-lower-timebase-steps-value.patch
+md-fix-race-when-unfreezing-sync_action.patch
+fs-binfmt_elf.c-load_elf_binary-return-einval-on-zero-length-mappings.patch
--- /dev/null
+From dc45708ca9988656d706940df5fd102672c5de92 Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Fri, 1 May 2015 11:03:02 -0700
+Subject: storvsc: Set the SRB flags correctly when no data transfer is needed
+
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+
+commit dc45708ca9988656d706940df5fd102672c5de92 upstream.
+
+Set the SRB flags correctly when there is no data transfer. Without this
+change some IHV drivers will fail valid commands such as TEST_UNIT_READY.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Reviewed-by: Long Li <longli@microsoft.com>
+Signed-off-by: James Bottomley <JBottomley@Odin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/storvsc_drv.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1565,8 +1565,7 @@ static int storvsc_queuecommand(struct S
+ break;
+ default:
+ vm_srb->data_in = UNKNOWN_TYPE;
+- vm_srb->win8_extension.srb_flags |= (SRB_FLAGS_DATA_IN |
+- SRB_FLAGS_DATA_OUT);
++ vm_srb->win8_extension.srb_flags |= SRB_FLAGS_NO_DATA_TRANSFER;
+ break;
+ }
+
--- /dev/null
+From 98fb1ffd8154890d7051750e61ff5548c3ee2ab2 Mon Sep 17 00:00:00 2001
+From: Kevin Cernekee <cernekee@chromium.org>
+Date: Wed, 22 Apr 2015 09:30:53 -0300
+Subject: UBI: block: Add missing cache flushes
+
+From: Kevin Cernekee <cernekee@chromium.org>
+
+commit 98fb1ffd8154890d7051750e61ff5548c3ee2ab2 upstream.
+
+Block drivers are responsible for calling flush_dcache_page() on each
+BIO request. This operation keeps the I$ coherent with the D$ on
+architectures that don't have hardware coherency support. Without this
+flush, random crashes are seen when executing user programs from an ext4
+filesystem backed by a ubiblock device.
+
+This patch is based on the change implemented in commit 2d4dc890b5c8
+("block: add helpers to run flush_dcache_page() against a bio and a
+request's pages").
+
+Fixes: 9d54c8a33eec ("UBI: R/O block driver on top of UBI volumes")
+Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
+Signed-off-by: Ezequiel Garcia <ezequiel.garcia@imgtec.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/ubi/block.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/ubi/block.c
++++ b/drivers/mtd/ubi/block.c
+@@ -310,6 +310,8 @@ static void ubiblock_do_work(struct work
+ blk_rq_map_sg(req->q, req, pdu->usgl.sg);
+
+ ret = ubiblock_read(pdu);
++ rq_flush_dcache_pages(req);
++
+ blk_mq_end_request(req, ret);
+ }
+
--- /dev/null
+From 161f873b89136eb1e69477c847d5a5033239d9ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Wed, 28 Jan 2015 15:30:43 -0500
+Subject: vfs: read file_handle only once in handle_to_path
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit 161f873b89136eb1e69477c847d5a5033239d9ba upstream.
+
+We used to read file_handle twice. Once to get the amount of extra
+bytes, and once to fetch the entire structure.
+
+This may be problematic since we do size verifications only after the
+first read, so if the number of extra bytes changes in userspace between
+the first and second calls, we'll have an incoherent view of
+file_handle.
+
+Instead, read the constant size once, and copy that over to the final
+structure without having to re-read it again.
+
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fhandle.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -195,8 +195,9 @@ static int handle_to_path(int mountdirfd
+ goto out_err;
+ }
+ /* copy the full handle */
+- if (copy_from_user(handle, ufh,
+- sizeof(struct file_handle) +
++ *handle = f_handle;
++ if (copy_from_user(&handle->f_handle,
++ &ufh->f_handle,
+ f_handle.handle_bytes)) {
+ retval = -EFAULT;
+ goto out_handle;
projects / thirdparty / kernel / stable-queue.git / commitdiff
