--- /dev/null
+From b9700be51bf00bbe9e1dabcb4838d6aa420192d1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andreas=20F=C3=A4rber?= <afaerber@suse.de>
+Date: Tue, 5 Jul 2016 06:04:08 +0200
+Subject: ARM: dts: imx6sx-sabreauto: Fix misspelled property
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andreas Färber <afaerber@suse.de>
+
+commit b9700be51bf00bbe9e1dabcb4838d6aa420192d1 upstream.
+
+In commit 99fc5ba0bfb6 ("ARM: dts: imx6sx: add i.mx6sx sabreauto board
+support") it should've been enable-sdio-wakeup (not -wakup). But that is
+now considered a legacy name for wakeup-source, so directly use the new
+name instead, as done in commit 26cefdd15db1 for the other occurrence.
+
+Fixes: 26cefdd15db1 ("ARM: dts: imx: replace legacy wakeup property with 'wakeup-source'")
+Signed-off-by: Andreas Färber <afaerber@suse.de>
+Acked-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6sx-sabreauto.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
++++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+@@ -64,7 +64,7 @@
+ cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
+ no-1-8-v;
+ keep-power-in-suspend;
+- enable-sdio-wakup;
++ wakeup-source;
+ status = "okay";
+ };
+
--- /dev/null
+From da60626e7d02a4f385cae80e450afc8b07035368 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 19 Aug 2016 16:34:45 +0100
+Subject: ARM: sa1100: clear reset status prior to reboot
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+commit da60626e7d02a4f385cae80e450afc8b07035368 upstream.
+
+Clear the current reset status prior to rebooting the platform. This
+adds the bit missing from 04fef228fb00 ("[ARM] pxa: introduce
+reset_status and clear_reset_status for driver's usage").
+
+Fixes: 04fef228fb00 ("[ARM] pxa: introduce reset_status and clear_reset_status for driver's usage")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-sa1100/generic.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/arm/mach-sa1100/generic.c
++++ b/arch/arm/mach-sa1100/generic.c
+@@ -34,6 +34,7 @@
+
+ #include <mach/hardware.h>
+ #include <mach/irqs.h>
++#include <mach/reset.h>
+
+ #include "generic.h"
+ #include <clocksource/pxa.h>
+@@ -95,6 +96,8 @@ static void sa1100_power_off(void)
+
+ void sa11x0_restart(enum reboot_mode mode, const char *cmd)
+ {
++ clear_reset_status(RESET_STATUS_ALL);
++
+ if (mode == REBOOT_SOFT) {
+ /* Jump into ROM at address 0 */
+ soft_restart(0);
--- /dev/null
+From 02ba38a5b6d6e0bc89c7b74651f1873055028a56 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 19 Aug 2016 12:44:29 +0100
+Subject: ARM: sa1100: fix 3.6864MHz clock
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+commit 02ba38a5b6d6e0bc89c7b74651f1873055028a56 upstream.
+
+pxa_timer wants to be able to call clk_enable() etc on this clock,
+but our clk_enable() implementation expects non-NULL enable/disable
+operations. Provide these dummy implementations.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000000
+pgd = c0204000
+[00000000] *pgd=00000000
+Internal error: Oops: 80000005 [#1] ARM
+Modules linked in:
+CPU: 0 PID: 0 Comm: swapper Not tainted 4.8.0-rc2+ #887
+Hardware name: Intel-Assabet
+task: c0644590 task.stack: c0640000
+PC is at 0x0
+LR is at clk_enable+0x40/0x58
+pc : [<00000000>] lr : [<c021b178>] psr: 600000d3
+sp : c0641f60 ip : c0641f4c fp : c0641f74
+r10: c1ffc7a0 r9 : 6901b118 r8 : 00000001
+r7 : c0639a34 r6 : 0000001b r5 : a00000d3 r4 : c0645d70
+r3 : c0645d78 r2 : 00000001 r1 : c0641ef0 r0 : c0645d70
+Flags: nZCv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none
+Control: c020717f Table: c020717f DAC: 00000053
+Process swapper (pid: 0, stack limit = 0xc0640188)
+Stack: (0xc0641f60 to 0xc0642000)
+1f60: 00384000 c08762e4 c0641f98 c0641f78 c063308c c021b144 00000000 00000000
+1f80: 00000000 c0660b20 ffffffff c0641fa8 c0641f9c c06220ec c0633058 c0641fb8
+1fa0: c0641fac c061f114 c06220dc c0641ff4 c0641fbc c061bb68 c061f0fc ffffffff
+1fc0: ffffffff 00000000 c061b6cc c0639a34 c0660cd4 c0642038 c0639a30 c0645434
+1fe0: c0204000 c06380f8 00000000 c0641ff8 c0208048 c061b954 00000000 00000000
+Backtrace:
+[<c021b138>] (clk_enable) from [<c063308c>] (pxa_timer_nodt_init+0x40/0x120)
+ r5:c08762e4 r4:00384000
+[<c063304c>] (pxa_timer_nodt_init) from [<c06220ec>] (sa1100_timer_init+0x1c/0x20)
+ r6:ffffffff r5:c0660b20 r4:00000000
+[<c06220d0>] (sa1100_timer_init) from [<c061f114>] (time_init+0x24/0x2c)
+[<c061f0f0>] (time_init) from [<c061bb68>] (start_kernel+0x220/0x42c)
+[<c061b948>] (start_kernel) from [<c0208048>] (0xc0208048)
+ r10:c06380f8 r8:c0204000 r7:c0645434 r6:c0639a30 r5:c0642038 r4:c0660cd4
+Code: bad PC value
+---[ end trace 0000000000000000 ]---
+Kernel panic - not syncing: Attempted to kill the idle task!
+
+Fixes: ee3a4020f7c9 ("ARM: 8250/1: sa1100: provide OSTIMER0 clock for pxa_timer")
+Acked-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-sa1100/clock.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm/mach-sa1100/clock.c
++++ b/arch/arm/mach-sa1100/clock.c
+@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(
+ }
+
+ static struct clkops clk_36864_ops = {
++ .enable = clk_cpu_enable,
++ .disable = clk_cpu_disable,
+ .get_rate = clk_36864_get_rate,
+ };
+
--- /dev/null
+From 198b51e8a6a31d3a6f8e9dd9cade3635d0291f26 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 19 Aug 2016 12:47:54 +0100
+Subject: ARM: sa1100: register clocks early
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+commit 198b51e8a6a31d3a6f8e9dd9cade3635d0291f26 upstream.
+
+Since we switched to use pxa_timer, we need to provide the OSTIMER0
+clock. However, as the clock is initialised early, we need to provide
+the clock early as well, so that pxa_timer can find it. Adding the
+clock to the clkdev table at core_initcall() time is way too late.
+
+Move the initialisation earlier.
+
+Fixes: ee3a4020f7c9 ("ARM: 8250/1: sa1100: provide OSTIMER0 clock for pxa_timer")
+Acked-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-sa1100/clock.c | 3 +--
+ arch/arm/mach-sa1100/generic.c | 1 +
+ arch/arm/mach-sa1100/generic.h | 2 ++
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-sa1100/clock.c
++++ b/arch/arm/mach-sa1100/clock.c
+@@ -140,9 +140,8 @@ static struct clk_lookup sa11xx_clkregs[
+ CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864),
+ };
+
+-static int __init sa11xx_clk_init(void)
++int __init sa11xx_clk_init(void)
+ {
+ clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs));
+ return 0;
+ }
+-core_initcall(sa11xx_clk_init);
+--- a/arch/arm/mach-sa1100/generic.c
++++ b/arch/arm/mach-sa1100/generic.c
+@@ -388,6 +388,7 @@ void __init sa1100_init_irq(void)
+ sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start);
+
+ sa1100_init_gpio();
++ sa11xx_clk_init();
+ }
+
+ /*
+--- a/arch/arm/mach-sa1100/generic.h
++++ b/arch/arm/mach-sa1100/generic.h
+@@ -44,3 +44,5 @@ int sa11x0_pm_init(void);
+ #else
+ static inline int sa11x0_pm_init(void) { return 0; }
+ #endif
++
++int sa11xx_clk_init(void);
--- /dev/null
+From 06dfe5cc0cc684e735cb0232fdb756d30780b05d Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Tue, 6 Sep 2016 14:34:05 +0100
+Subject: ARM: sa1111: fix pcmcia suspend/resume
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+commit 06dfe5cc0cc684e735cb0232fdb756d30780b05d upstream.
+
+SA1111 PCMCIA was broken when PCMCIA switched to using dev_pm_ops for
+the PCMCIA socket class. PCMCIA used to handle suspend/resume via the
+socket hosting device, which happened at normal device suspend/resume
+time.
+
+However, the referenced commit changed this: much of the resume now
+happens much earlier, in the noirq resume handler of dev_pm_ops.
+
+However, on SA1111, the PCMCIA device is not accessible as the SA1111
+has not been resumed at _noirq time. It's slightly worse than that,
+because the SA1111 has already been put to sleep at _noirq time, so
+suspend doesn't work properly.
+
+Fix this by converting the core SA1111 code to use dev_pm_ops as well,
+and performing its own suspend/resume at noirq time.
+
+This fixes these errors in the kernel log:
+
+pcmcia_socket pcmcia_socket0: time out after reset
+pcmcia_socket pcmcia_socket1: time out after reset
+
+and the resulting lack of PCMCIA cards after a S2RAM cycle.
+
+Fixes: d7646f7632549 ("pcmcia: use dev_pm_ops for class pcmcia_socket_class")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/common/sa1111.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+--- a/arch/arm/common/sa1111.c
++++ b/arch/arm/common/sa1111.c
+@@ -869,9 +869,9 @@ struct sa1111_save_data {
+
+ #ifdef CONFIG_PM
+
+-static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
++static int sa1111_suspend_noirq(struct device *dev)
+ {
+- struct sa1111 *sachip = platform_get_drvdata(dev);
++ struct sa1111 *sachip = dev_get_drvdata(dev);
+ struct sa1111_save_data *save;
+ unsigned long flags;
+ unsigned int val;
+@@ -934,9 +934,9 @@ static int sa1111_suspend(struct platfor
+ * restored by their respective drivers, and must be called
+ * via LDM after this function.
+ */
+-static int sa1111_resume(struct platform_device *dev)
++static int sa1111_resume_noirq(struct device *dev)
+ {
+- struct sa1111 *sachip = platform_get_drvdata(dev);
++ struct sa1111 *sachip = dev_get_drvdata(dev);
+ struct sa1111_save_data *save;
+ unsigned long flags, id;
+ void __iomem *base;
+@@ -952,7 +952,7 @@ static int sa1111_resume(struct platform
+ id = sa1111_readl(sachip->base + SA1111_SKID);
+ if ((id & SKID_ID_MASK) != SKID_SA1111_ID) {
+ __sa1111_remove(sachip);
+- platform_set_drvdata(dev, NULL);
++ dev_set_drvdata(dev, NULL);
+ kfree(save);
+ return 0;
+ }
+@@ -1003,8 +1003,8 @@ static int sa1111_resume(struct platform
+ }
+
+ #else
+-#define sa1111_suspend NULL
+-#define sa1111_resume NULL
++#define sa1111_suspend_noirq NULL
++#define sa1111_resume_noirq NULL
+ #endif
+
+ static int sa1111_probe(struct platform_device *pdev)
+@@ -1038,6 +1038,11 @@ static int sa1111_remove(struct platform
+ return 0;
+ }
+
++static struct dev_pm_ops sa1111_pm_ops = {
++ .suspend_noirq = sa1111_suspend_noirq,
++ .resume_noirq = sa1111_resume_noirq,
++};
++
+ /*
+ * Not sure if this should be on the system bus or not yet.
+ * We really want some way to register a system device at
+@@ -1050,10 +1055,9 @@ static int sa1111_remove(struct platform
+ static struct platform_driver sa1111_device_driver = {
+ .probe = sa1111_probe,
+ .remove = sa1111_remove,
+- .suspend = sa1111_suspend,
+- .resume = sa1111_resume,
+ .driver = {
+ .name = "sa1111",
++ .pm = &sa1111_pm_ops,
+ },
+ };
+
--- /dev/null
+From c2f321126e31cd69365e65ecd4a7c774e4fc71d2 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Tue, 30 Aug 2016 21:50:22 +0200
+Subject: ARM: shmobile: fix regulator quirk for Gen2
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit c2f321126e31cd69365e65ecd4a7c774e4fc71d2 upstream.
+
+The current implementation only works if the da9xxx devices are added
+before their drivers are registered. Only then it can apply the fixes to
+both devices. Otherwise, the driver for the first device gets probed
+before the fix for the second device can be applied. This is what
+fails when using the IP core switcher or when having the i2c master
+driver as a module.
+
+So, we need to disable both da9xxx once we detected one of them. We now
+use i2c_transfer with hardcoded i2c_messages and device addresses, so we
+don't need the da9xxx client devices to be instantiated. Because the
+fixup is used on specific boards only, the addresses are not going to
+change.
+
+Fixes: 663fbb52159cca ("ARM: shmobile: R-Car Gen2: Add da9063/da9210 regulator quirk")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> (r8a7791/koelsch)
+Tested-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c | 62 ++++++++-------------
+ 1 file changed, 26 insertions(+), 36 deletions(-)
+
+--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
++++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
+@@ -41,39 +41,26 @@
+
+ #define REGULATOR_IRQ_MASK BIT(2) /* IRQ2, active low */
+
+-static void __iomem *irqc;
+-
+-static const u8 da9063_mask_regs[] = {
+- DA9063_REG_IRQ_MASK_A,
+- DA9063_REG_IRQ_MASK_B,
+- DA9063_REG_IRQ_MASK_C,
+- DA9063_REG_IRQ_MASK_D,
+-};
+-
+-/* DA9210 System Control and Event Registers */
++/* start of DA9210 System Control and Event Registers */
+ #define DA9210_REG_MASK_A 0x54
+-#define DA9210_REG_MASK_B 0x55
+-
+-static const u8 da9210_mask_regs[] = {
+- DA9210_REG_MASK_A,
+- DA9210_REG_MASK_B,
+-};
+
+-static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[],
+- unsigned int nregs)
+-{
+- unsigned int i;
+-
+- dev_info(&client->dev, "Masking %s interrupt sources\n", client->name);
++static void __iomem *irqc;
+
+- for (i = 0; i < nregs; i++) {
+- int error = i2c_smbus_write_byte_data(client, regs[i], ~0);
+- if (error) {
+- dev_err(&client->dev, "i2c error %d\n", error);
+- return;
+- }
+- }
+-}
++/* first byte sets the memory pointer, following are consecutive reg values */
++static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff };
++static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff };
++
++static struct i2c_msg da9xxx_msgs[2] = {
++ {
++ .addr = 0x58,
++ .len = ARRAY_SIZE(da9063_irq_clr),
++ .buf = da9063_irq_clr,
++ }, {
++ .addr = 0x68,
++ .len = ARRAY_SIZE(da9210_irq_clr),
++ .buf = da9210_irq_clr,
++ },
++};
+
+ static int regulator_quirk_notify(struct notifier_block *nb,
+ unsigned long action, void *data)
+@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct
+ client = to_i2c_client(dev);
+ dev_dbg(dev, "Detected %s\n", client->name);
+
+- if ((client->addr == 0x58 && !strcmp(client->name, "da9063")))
+- da9xxx_mask_irqs(client, da9063_mask_regs,
+- ARRAY_SIZE(da9063_mask_regs));
+- else if (client->addr == 0x68 && !strcmp(client->name, "da9210"))
+- da9xxx_mask_irqs(client, da9210_mask_regs,
+- ARRAY_SIZE(da9210_mask_regs));
++ if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) ||
++ (client->addr == 0x68 && !strcmp(client->name, "da9210"))) {
++ int ret;
++
++ dev_info(&client->dev, "clearing da9063/da9210 interrupts\n");
++ ret = i2c_transfer(client->adapter, da9xxx_msgs, ARRAY_SIZE(da9xxx_msgs));
++ if (ret != ARRAY_SIZE(da9xxx_msgs))
++ dev_err(&client->dev, "i2c error %d\n", ret);
++ }
+
+ mon = ioread32(irqc + IRQC_MONITOR);
+ if (mon & REGULATOR_IRQ_MASK)
--- /dev/null
+From 539d5c48a4aff5a4afcff117418618b49126c54c Mon Sep 17 00:00:00 2001
+From: Hugo Grostabussiat <bonstra@bonstra.fr.eu.org>
+Date: Tue, 16 Aug 2016 20:34:07 +0200
+Subject: ARM: sun5i: Fix typo in trip point temperature
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Hugo Grostabussiat <bonstra@bonstra.fr.eu.org>
+
+commit 539d5c48a4aff5a4afcff117418618b49126c54c upstream.
+
+Set cpu_alert0 temperature to 85°C instead of 850°C.
+
+Fixes: 32a5d2d170cc ("ARM: dts: sun5i: Add cpu thermal zones to dtsi")
+Signed-off-by: Hugo Grostabussiat <bonstra@bonstra.fr.eu.org>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/sun5i-a13.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/sun5i-a13.dtsi
++++ b/arch/arm/boot/dts/sun5i-a13.dtsi
+@@ -84,7 +84,7 @@
+ trips {
+ cpu_alert0: cpu_alert0 {
+ /* milliCelsius */
+- temperature = <850000>;
++ temperature = <85000>;
+ hysteresis = <2000>;
+ type = "passive";
+ };
--- /dev/null
+From aaab50fcea78ae3414c3afc25aae8d0603df34d0 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Wed, 29 Jun 2016 19:29:30 +0300
+Subject: ath9k: Fix programming of minCCA power threshold
+
+From: Sven Eckelmann <sven@narfation.org>
+
+commit aaab50fcea78ae3414c3afc25aae8d0603df34d0 upstream.
+
+The function ar9003_hw_apply_minccapwr_thresh takes as second parameter not
+a pointer to the channel but a boolean value describing whether the channel
+is 2.4GHz or not. This broke (according to the origin commit) the ETSI
+regulatory compliance on 5GHz channels.
+
+Fixes: 3533bf6b15a0 ("ath9k: Fix regulatory compliance")
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Cc: Simon Wunderlich <sw@simonwunderlich.de>
+Cc: Sujith Manoharan <c_manoha@qca.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -4176,7 +4176,7 @@ static void ath9k_hw_ar9300_set_board_va
+ if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah))
+ ar9003_hw_internal_regulator_apply(ah);
+ ar9003_hw_apply_tuning_caps(ah);
+- ar9003_hw_apply_minccapwr_thresh(ah, chan);
++ ar9003_hw_apply_minccapwr_thresh(ah, is2ghz);
+ ar9003_hw_txend_to_xpa_off_apply(ah, is2ghz);
+ ar9003_hw_thermometer_apply(ah);
+ ar9003_hw_thermo_cal_apply(ah);
--- /dev/null
+From 55f1cf83d5cf885c75267269729805852039c834 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 13 Jul 2016 13:08:55 +0300
+Subject: avr32: off by one in at32_init_pio()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 55f1cf83d5cf885c75267269729805852039c834 upstream.
+
+The pio_dev[] array has MAX_NR_PIO_DEVICES elements so the > should be
+>=.
+
+Fixes: 5f97f7f9400d ('[PATCH] avr32 architecture')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/avr32/mach-at32ap/pio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/avr32/mach-at32ap/pio.c
++++ b/arch/avr32/mach-at32ap/pio.c
+@@ -435,7 +435,7 @@ void __init at32_init_pio(struct platfor
+ struct resource *regs;
+ struct pio_device *pio;
+
+- if (pdev->id > MAX_NR_PIO_DEVICES) {
++ if (pdev->id >= MAX_NR_PIO_DEVICES) {
+ dev_err(&pdev->dev, "only %d PIO devices supported\n",
+ MAX_NR_PIO_DEVICES);
+ return;
--- /dev/null
+From 52b9c330c6a8a4b5a1819bdaddf4ec76ab571e81 Mon Sep 17 00:00:00 2001
+From: Omar Sandoval <osandov@fb.com>
+Date: Wed, 8 Jun 2016 18:22:20 -0700
+Subject: blk-mq: actually hook up defer list when running requests
+
+From: Omar Sandoval <osandov@fb.com>
+
+commit 52b9c330c6a8a4b5a1819bdaddf4ec76ab571e81 upstream.
+
+If ->queue_rq() returns BLK_MQ_RQ_QUEUE_OK, we use continue and skip
+over the rest of the loop body. However, dptr is assigned later in the
+loop body, and the BLK_MQ_RQ_QUEUE_OK case is exactly the case that we'd
+want it for.
+
+NVMe isn't actually using BLK_MQ_F_DEFER_ISSUE yet, nor is any other
+in-tree driver, but if the code's going to be there, it might as well
+work.
+
+Fixes: 74c450521dd8 ("blk-mq: add a 'list' parameter to ->queue_rq()")
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-mq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -784,7 +784,7 @@ static void __blk_mq_run_hw_queue(struct
+ switch (ret) {
+ case BLK_MQ_RQ_QUEUE_OK:
+ queued++;
+- continue;
++ break;
+ case BLK_MQ_RQ_QUEUE_BUSY:
+ list_add(&rq->queuelist, &rq_list);
+ __blk_mq_requeue_request(rq);
--- /dev/null
+From dbb50887c8f619fc5c3489783ebc3122bc134a31 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Wed, 27 Jul 2016 11:40:14 -0700
+Subject: Bluetooth: split sk_filter in l2cap_sock_recv_cb
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+commit dbb50887c8f619fc5c3489783ebc3122bc134a31 upstream.
+
+During an audit for sk_filter(), we found that rx_busy_skb handling
+in l2cap_sock_recv_cb() and l2cap_sock_recvmsg() looks not quite as
+intended.
+
+The assumption from commit e328140fdacb ("Bluetooth: Use event-driven
+approach for handling ERTM receive buffer") is that errors returned
+from sock_queue_rcv_skb() are due to receive buffer shortage. However,
+nothing should prevent doing a setsockopt() with SO_ATTACH_FILTER on
+the socket, that could drop some of the incoming skbs when handled in
+sock_queue_rcv_skb().
+
+In that case sock_queue_rcv_skb() will return with -EPERM, propagated
+from sk_filter() and if in L2CAP_MODE_ERTM mode, wrong assumption was
+that we failed due to receive buffer being full. From that point onwards,
+due to the to-be-dropped skb being held in rx_busy_skb, we cannot make
+any forward progress as rx_busy_skb is never cleared from l2cap_sock_recvmsg(),
+due to the filter drop verdict over and over coming from sk_filter().
+Meanwhile, in l2cap_sock_recv_cb() all new incoming skbs are being
+dropped due to rx_busy_skb being occupied.
+
+Instead, just use __sock_queue_rcv_skb() where an error really tells that
+there's a receive buffer issue. Split the sk_filter() and enable it for
+non-segmented modes at queuing time since at this point in time the skb has
+already been through the ERTM state machine and it has been acked, so dropping
+is not allowed. Instead, for ERTM and streaming mode, call sk_filter() in
+l2cap_data_rcv() so the packet can be dropped before the state machine sees it.
+
+Fixes: e328140fdacb ("Bluetooth: Use event-driven approach for handling ERTM receive buffer")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/l2cap_core.c | 8 ++++++++
+ net/bluetooth/l2cap_sock.c | 14 ++++++++++++--
+ 2 files changed, 20 insertions(+), 2 deletions(-)
+
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -32,6 +32,7 @@
+
+ #include <linux/debugfs.h>
+ #include <linux/crc16.h>
++#include <linux/filter.h>
+
+ #include <net/bluetooth/bluetooth.h>
+ #include <net/bluetooth/hci_core.h>
+@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l
+ if (chan->sdu)
+ break;
+
++ if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
++ break;
++
+ chan->sdu_len = get_unaligned_le16(skb->data);
+ skb_pull(skb, L2CAP_SDULEN_SIZE);
+
+@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_c
+ goto drop;
+ }
+
++ if ((chan->mode == L2CAP_MODE_ERTM ||
++ chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
++ goto drop;
++
+ if (!control->sframe) {
+ int err;
+
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct soc
+ goto done;
+
+ if (pi->rx_busy_skb) {
+- if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
++ if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+ pi->rx_busy_skb = NULL;
+ else
+ goto done;
+@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2c
+ goto done;
+ }
+
+- err = sock_queue_rcv_skb(sk, skb);
++ if (chan->mode != L2CAP_MODE_ERTM &&
++ chan->mode != L2CAP_MODE_STREAMING) {
++ /* Even if no filter is attached, we could potentially
++ * get errors from security modules, etc.
++ */
++ err = sk_filter(sk, skb);
++ if (err)
++ goto done;
++ }
++
++ err = __sock_queue_rcv_skb(sk, skb);
+
+ /* For ERTM, handle one skb that doesn't fit into the recv
+ * buffer. This is important to do because the data frames
--- /dev/null
+From 3935e08768ff777da6496521b1fc36f72823672c Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Wed, 29 Jun 2016 19:44:51 +0200
+Subject: dmaengine: at_xdmac: fix debug string
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit 3935e08768ff777da6496521b1fc36f72823672c upstream.
+
+mbr_ds is an integer, don't use %pad to print it.
+
+Fixes: commit 268914f4e7a0 ("dmaengine: at_xdmac: use %pad format string for dma_addr_t")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_xdmac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1195,8 +1195,8 @@ static struct at_xdmac_desc *at_xdmac_me
+ desc->lld.mbr_cfg = chan_cc;
+
+ dev_dbg(chan2dev(chan),
+- "%s: lld: mbr_da=%pad, mbr_ds=%pad, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
+- __func__, &desc->lld.mbr_da, &desc->lld.mbr_ds, desc->lld.mbr_ubc,
++ "%s: lld: mbr_da=%pad, mbr_ds=0x%08x, mbr_ubc=0x%08x, mbr_cfg=0x%08x\n",
++ __func__, &desc->lld.mbr_da, desc->lld.mbr_ds, desc->lld.mbr_ubc,
+ desc->lld.mbr_cfg);
+
+ return desc;
--- /dev/null
+From 4aa819c79bb73f3d1bdf5244d0a0f7f15261504c Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 30 Jun 2016 14:47:10 +0200
+Subject: dmaengine: bcm2835: fix 64-bit warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 4aa819c79bb73f3d1bdf5244d0a0f7f15261504c upstream.
+
+When building this driver on arm64, we get a harmless type
+mismatch warning:
+
+drivers/dma/bcm2835-dma.c: In function 'bcm2835_dma_fill_cb_chain_with_sg':
+include/linux/kernel.h:743:17: warning: comparison of distinct pointer types lacks a cast
+ (void) (&_min1 == &_min2); \
+ ^
+drivers/dma/bcm2835-dma.c:409:21: note: in expansion of macro 'min'
+ cb->cb->length = min(len, max_len);
+
+This changes the type of the 'len' variable to size_t, which
+avoids the problem.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 388cc7a281c0 ("dmaengine: bcm2835: add slave_sg support to bcm2835-dma")
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/bcm2835-dma.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -393,11 +393,12 @@ static void bcm2835_dma_fill_cb_chain_wi
+ unsigned int sg_len)
+ {
+ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+- size_t max_len = bcm2835_dma_max_frame_length(c);
+- unsigned int i, len;
++ size_t len, max_len;
++ unsigned int i;
+ dma_addr_t addr;
+ struct scatterlist *sgent;
+
++ max_len = bcm2835_dma_max_frame_length(c);
+ for_each_sg(sgl, sgent, sg_len, i) {
+ for (addr = sg_dma_address(sgent), len = sg_dma_len(sgent);
+ len > 0;
--- /dev/null
+From e44c153b30c9a0580fc2b5a93f3c6d593def2278 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 9 May 2016 05:22:55 -0300
+Subject: [media] em28xx-i2c: rt_mutex_trylock() returns zero on failure
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit e44c153b30c9a0580fc2b5a93f3c6d593def2278 upstream.
+
+The code is checking for negative returns but it should be checking for
+zero.
+
+Fixes: aab3125c43d8 ('[media] em28xx: add support for registering multiple i2c buses')
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-i2c.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-i2c.c
++++ b/drivers/media/usb/em28xx/em28xx-i2c.c
+@@ -507,9 +507,8 @@ static int em28xx_i2c_xfer(struct i2c_ad
+ if (dev->disconnected)
+ return -ENODEV;
+
+- rc = rt_mutex_trylock(&dev->i2c_bus_lock);
+- if (rc < 0)
+- return rc;
++ if (!rt_mutex_trylock(&dev->i2c_bus_lock))
++ return -EAGAIN;
+
+ /* Switch I2C bus if needed */
+ if (bus != dev->cur_i2c_bus &&
--- /dev/null
+From 34875887f360d7bd0b7f0a89f7c6d65eca616ee3 Mon Sep 17 00:00:00 2001
+From: Jacob Keller <jacob.e.keller@intel.com>
+Date: Mon, 18 Apr 2016 15:45:00 -0700
+Subject: fm10k: fix incorrect index calculation in fm10k_write_reta
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+commit 34875887f360d7bd0b7f0a89f7c6d65eca616ee3 upstream.
+
+The index calculated when looping through the indir array passed to
+fm10k_write_reta was incorrectly calculated as the first part i needs to
+be multiplied by 4.
+
+Fixes: 0cfea7a65738 ("fm10k: fix possible null pointer deref after kcalloc", 2016-04-13)
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Tested-by: Krishneil Singh <Krishneil.k.singh@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
++++ b/drivers/net/ethernet/intel/fm10k/fm10k_ethtool.c
+@@ -983,9 +983,10 @@ void fm10k_write_reta(struct fm10k_intfc
+ /* generate a new table if we weren't given one */
+ for (j = 0; j < 4; j++) {
+ if (indir)
+- n = indir[i + j];
++ n = indir[4 * i + j];
+ else
+- n = ethtool_rxfh_indir_default(i + j, rss_i);
++ n = ethtool_rxfh_indir_default(4 * i + j,
++ rss_i);
+
+ table[j] = n;
+ }
--- /dev/null
+From dd7328e4c53649c1c7ec36bc1cf5b229b8662047 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 7 Jul 2016 11:23:59 +0300
+Subject: fnic: pci_dma_mapping_error() doesn't return an error code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit dd7328e4c53649c1c7ec36bc1cf5b229b8662047 upstream.
+
+pci_dma_mapping_error() returns true on error and false on success.
+
+Fixes: fd6ddfa4c1dd ('fnic: check pci_map_single() return value')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/fnic/fnic_fcs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/fnic/fnic_fcs.c
++++ b/drivers/scsi/fnic/fnic_fcs.c
+@@ -954,8 +954,8 @@ int fnic_alloc_rq_frame(struct vnic_rq *
+ skb_put(skb, len);
+ pa = pci_map_single(fnic->pdev, skb->data, len, PCI_DMA_FROMDEVICE);
+
+- r = pci_dma_mapping_error(fnic->pdev, pa);
+- if (r) {
++ if (pci_dma_mapping_error(fnic->pdev, pa)) {
++ r = -ENOMEM;
+ printk(KERN_ERR "PCI mapping failed with error %d\n", r);
+ goto free_skb;
+ }
+@@ -1093,8 +1093,8 @@ static int fnic_send_frame(struct fnic *
+
+ pa = pci_map_single(fnic->pdev, eth_hdr, tot_len, PCI_DMA_TODEVICE);
+
+- ret = pci_dma_mapping_error(fnic->pdev, pa);
+- if (ret) {
++ if (pci_dma_mapping_error(fnic->pdev, pa)) {
++ ret = -ENOMEM;
+ printk(KERN_ERR "DMA map failed with error %d\n", ret);
+ goto free_skb_on_err;
+ }
--- /dev/null
+From d7e92e15e92fc987640772bf110586898b5f15aa Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 4 Jul 2016 10:21:40 -0300
+Subject: [media] gspca: avoid unused variable warnings
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit d7e92e15e92fc987640772bf110586898b5f15aa upstream.
+
+When CONFIG_INPUT is disabled, multiple gspca backend drivers
+print compile-time warnings about unused variables:
+
+media/usb/gspca/cpia1.c: In function 'sd_stopN':
+media/usb/gspca/cpia1.c:1627:13: error: unused variable 'sd' [-Werror=unused-variable]
+media/usb/gspca/konica.c: In function 'sd_stopN':
+media/usb/gspca/konica.c:246:13: error: unused variable 'sd' [-Werror=unused-variable]
+
+This annotates the variables as __maybe_unused, to let the compiler
+know that they are declared intentionally.
+
+Fixes: ee186fd96a5f ("[media] gscpa_t613: Add support for the camera button")
+Fixes: c2f644aeeba3 ("[media] gspca_cpia1: Add support for button")
+Fixes: b517af722860 ("V4L/DVB: gspca_konica: New gspca subdriver for konica chipset using cams")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/gspca/cpia1.c | 2 +-
+ drivers/media/usb/gspca/konica.c | 2 +-
+ drivers/media/usb/gspca/t613.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/usb/gspca/cpia1.c
++++ b/drivers/media/usb/gspca/cpia1.c
+@@ -1624,7 +1624,7 @@ static int sd_start(struct gspca_dev *gs
+
+ static void sd_stopN(struct gspca_dev *gspca_dev)
+ {
+- struct sd *sd = (struct sd *) gspca_dev;
++ struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
+
+ command_pause(gspca_dev);
+
+--- a/drivers/media/usb/gspca/konica.c
++++ b/drivers/media/usb/gspca/konica.c
+@@ -243,7 +243,7 @@ static int sd_start(struct gspca_dev *gs
+
+ static void sd_stopN(struct gspca_dev *gspca_dev)
+ {
+- struct sd *sd = (struct sd *) gspca_dev;
++ struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
+
+ konica_stream_off(gspca_dev);
+ #if IS_ENABLED(CONFIG_INPUT)
+--- a/drivers/media/usb/gspca/t613.c
++++ b/drivers/media/usb/gspca/t613.c
+@@ -837,7 +837,7 @@ static void sd_pkt_scan(struct gspca_dev
+ u8 *data, /* isoc packet */
+ int len) /* iso packet length */
+ {
+- struct sd *sd = (struct sd *) gspca_dev;
++ struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
+ int pkt_type;
+
+ if (data[0] == 0x5a) {
--- /dev/null
+From 61dc0a446e5d08f2de8a24b45f69a1e302bb1b1b Mon Sep 17 00:00:00 2001
+From: Nishanth Menon <nm@ti.com>
+Date: Fri, 24 Jun 2016 11:50:39 -0500
+Subject: hwrng: omap - Fix assumption that runtime_get_sync will always succeed
+
+From: Nishanth Menon <nm@ti.com>
+
+commit 61dc0a446e5d08f2de8a24b45f69a1e302bb1b1b upstream.
+
+pm_runtime_get_sync does return a error value that must be checked for
+error conditions, else, due to various reasons, the device maynot be
+enabled and the system will crash due to lack of clock to the hardware
+module.
+
+Before:
+12.562784] [00000000] *pgd=fe193835
+12.562792] Internal error: : 1406 [#1] SMP ARM
+[...]
+12.562864] CPU: 1 PID: 241 Comm: modprobe Not tainted 4.7.0-rc4-next-20160624 #2
+12.562867] Hardware name: Generic DRA74X (Flattened Device Tree)
+12.562872] task: ed51f140 ti: ed44c000 task.ti: ed44c000
+12.562886] PC is at omap4_rng_init+0x20/0x84 [omap_rng]
+12.562899] LR is at set_current_rng+0xc0/0x154 [rng_core]
+[...]
+
+After the proper checks:
+[ 94.366705] omap_rng 48090000.rng: _od_fail_runtime_resume: FIXME:
+missing hwmod/omap_dev info
+[ 94.375767] omap_rng 48090000.rng: Failed to runtime_get device -19
+[ 94.382351] omap_rng 48090000.rng: initialization failed.
+
+Fixes: 665d92fa85b5 ("hwrng: OMAP: convert to use runtime PM")
+Cc: Paul Walmsley <paul@pwsan.com>
+Signed-off-by: Nishanth Menon <nm@ti.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/hw_random/omap-rng.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/hw_random/omap-rng.c
++++ b/drivers/char/hw_random/omap-rng.c
+@@ -384,7 +384,12 @@ static int omap_rng_probe(struct platfor
+ }
+
+ pm_runtime_enable(&pdev->dev);
+- pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_get_sync(&pdev->dev);
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret);
++ pm_runtime_put_noidle(&pdev->dev);
++ goto err_ioremap;
++ }
+
+ ret = (dev->of_node) ? of_get_omap_rng_device_details(priv, pdev) :
+ get_omap_rng_device_details(priv);
+@@ -435,8 +440,15 @@ static int __maybe_unused omap_rng_suspe
+ static int __maybe_unused omap_rng_resume(struct device *dev)
+ {
+ struct omap_rng_dev *priv = dev_get_drvdata(dev);
++ int ret;
++
++ ret = pm_runtime_get_sync(dev);
++ if (ret) {
++ dev_err(dev, "Failed to runtime_get device: %d\n", ret);
++ pm_runtime_put_noidle(dev);
++ return ret;
++ }
+
+- pm_runtime_get_sync(dev);
+ priv->pdata->init(priv);
+
+ return 0;
--- /dev/null
+From 849a9627299100ae3f0ce573fc87d2b476f3bb59 Mon Sep 17 00:00:00 2001
+From: striebit <shaul.triebitz@intel.com>
+Date: Tue, 7 Jun 2016 15:05:26 +0300
+Subject: iwlmvm: mvm: set correct state in smart-fifo configuration
+
+From: striebit <shaul.triebitz@intel.com>
+
+commit 849a9627299100ae3f0ce573fc87d2b476f3bb59 upstream.
+
+Currently the state sent in SF configuration is always
+FULL_ON.
+This commit sets the correct state (e.g. INIT_OFF
+when station is not associated).
+
+Fixes: commit f4a3ee493e69 ("iwlwifi: mvm: Always enable the smart FIFO")
+Signed-off-by: Shaul Triebitz <shaul.triebitz@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sf.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sf.c
+@@ -215,7 +215,7 @@ static int iwl_mvm_sf_config(struct iwl_
+ enum iwl_sf_state new_state)
+ {
+ struct iwl_sf_cfg_cmd sf_cmd = {
+- .state = cpu_to_le32(SF_FULL_ON),
++ .state = cpu_to_le32(new_state),
+ };
+ struct ieee80211_sta *sta;
+ int ret = 0;
--- /dev/null
+From ed76b7a131f41c91b0c725d472f9b969d75ce888 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Thu, 1 Sep 2016 16:14:50 -0700
+Subject: lib/test_hash.c: fix warning in two-dimensional array init
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit ed76b7a131f41c91b0c725d472f9b969d75ce888 upstream.
+
+ lib/test_hash.c: In function 'test_hash_init':
+ lib/test_hash.c:146:2: warning: missing braces around initializer [-Wmissing-braces]
+
+Fixes: 468a9428521e7d00 ("<linux/hash.h>: Add support for architecture-specific functions")
+Link: http://lkml.kernel.org/r/20160829214952.1334674-3-arnd@arndb.de
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: George Spelvin <linux@sciencehorizons.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ lib/test_hash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/test_hash.c
++++ b/lib/test_hash.c
+@@ -143,7 +143,7 @@ static int __init
+ test_hash_init(void)
+ {
+ char buf[SIZE+1];
+- u32 string_or = 0, hash_or[2][33] = { 0 };
++ u32 string_or = 0, hash_or[2][33] = { { 0, } };
+ unsigned tests = 0;
+ unsigned long long h64 = 0;
+ int i, j;
--- /dev/null
+From 9ef3c5112139cc5c5666ee096e05bc1e00e94015 Mon Sep 17 00:00:00 2001
+From: Sudeep Holla <sudeep.holla@arm.com>
+Date: Tue, 24 May 2016 17:12:04 +0100
+Subject: mailbox: mailbox-test: set tdev->signal to NULL after freeing
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+commit 9ef3c5112139cc5c5666ee096e05bc1e00e94015 upstream.
+
+tdev->signal is not set NULL after it's freed. This will cause random
+exceptions when the stale pointer is accessed after tdev->signal is
+freed. Also, since tdev->signal allocation is skipped the next time
+it's written, this leads to continuous fault finally leading to the
+total death of the system.
+
+Fixes: d1c2f87c9a8f ("mailbox: mailbox-test: Prevent memory leak")
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Acked-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mailbox/mailbox-test.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mailbox/mailbox-test.c
++++ b/drivers/mailbox/mailbox-test.c
+@@ -133,6 +133,7 @@ static ssize_t mbox_test_message_write(s
+ out:
+ kfree(tdev->signal);
+ kfree(tdev->message);
++ tdev->signal = NULL;
+
+ return ret < 0 ? ret : count;
+ }
--- /dev/null
+From c146a2b98eb5898eb0fab15a332257a4102ecae9 Mon Sep 17 00:00:00 2001
+From: Alexander Potapenko <glider@google.com>
+Date: Thu, 28 Jul 2016 15:49:04 -0700
+Subject: mm, kasan: account for object redzone in SLUB's nearest_obj()
+
+From: Alexander Potapenko <glider@google.com>
+
+commit c146a2b98eb5898eb0fab15a332257a4102ecae9 upstream.
+
+When looking up the nearest SLUB object for a given address, correctly
+calculate its offset if SLAB_RED_ZONE is enabled for that cache.
+
+Previously, when KASAN had detected an error on an object from a cache
+with SLAB_RED_ZONE set, the actual start address of the object was
+miscalculated, which led to random stacks having been reported.
+
+When looking up the nearest SLUB object for a given address, correctly
+calculate its offset if SLAB_RED_ZONE is enabled for that cache.
+
+Fixes: 7ed2f9e663854db ("mm, kasan: SLAB support")
+Link: http://lkml.kernel.org/r/1468347165-41906-2-git-send-email-glider@google.com
+Signed-off-by: Alexander Potapenko <glider@google.com>
+Cc: Andrey Konovalov <adech.fo@gmail.com>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: Steven Rostedt (Red Hat) <rostedt@goodmis.org>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Kostya Serebryany <kcc@google.com>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Cc: Kuthonuzo Luruo <kuthonuzo.luruo@hpe.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/slub_def.h | 10 ++++++----
+ mm/slub.c | 2 +-
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/include/linux/slub_def.h
++++ b/include/linux/slub_def.h
+@@ -114,15 +114,17 @@ static inline void sysfs_slab_remove(str
+ void object_err(struct kmem_cache *s, struct page *page,
+ u8 *object, char *reason);
+
++void *fixup_red_left(struct kmem_cache *s, void *p);
++
+ static inline void *nearest_obj(struct kmem_cache *cache, struct page *page,
+ void *x) {
+ void *object = x - (x - page_address(page)) % cache->size;
+ void *last_object = page_address(page) +
+ (page->objects - 1) * cache->size;
+- if (unlikely(object > last_object))
+- return last_object;
+- else
+- return object;
++ void *result = (unlikely(object > last_object)) ? last_object : object;
++
++ result = fixup_red_left(cache, result);
++ return result;
+ }
+
+ #endif /* _LINUX_SLUB_DEF_H */
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -124,7 +124,7 @@ static inline int kmem_cache_debug(struc
+ #endif
+ }
+
+-static inline void *fixup_red_left(struct kmem_cache *s, void *p)
++inline void *fixup_red_left(struct kmem_cache *s, void *p)
+ {
+ if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE)
+ p += s->red_left_pad;
--- /dev/null
+From fa1ce54ea38f7f83473fce62e64fefbd7ebd170e Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Sun, 5 Jun 2016 11:17:10 +0200
+Subject: NFC: fdp: Detect errors from fdp_nci_create_conn()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit fa1ce54ea38f7f83473fce62e64fefbd7ebd170e upstream.
+
+drivers/nfc/fdp/fdp.c: In function ‘fdp_nci_patch_otp’:
+drivers/nfc/fdp/fdp.c:373: warning: comparison is always false due to limited range of data type
+drivers/nfc/fdp/fdp.c: In function ‘fdp_nci_patch_ram’:
+drivers/nfc/fdp/fdp.c:444: warning: comparison is always false due to limited range of data type
+
+fdp_nci_create_conn() may return a negative error code, which is
+silently ignored by assigning it to a u8.
+
+Change conn_id from u8 to int to fix this.
+
+Fixes: a06347c04c13e380 ("NFC: Add Intel Fields Peak NFC solution driver")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nfc/fdp/fdp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/nfc/fdp/fdp.c
++++ b/drivers/nfc/fdp/fdp.c
+@@ -353,7 +353,7 @@ static int fdp_nci_patch_otp(struct nci_
+ {
+ struct fdp_nci_info *info = nci_get_drvdata(ndev);
+ struct device *dev = &info->phy->i2c_dev->dev;
+- u8 conn_id;
++ int conn_id;
+ int r = 0;
+
+ if (info->otp_version >= info->otp_patch_version)
+@@ -424,7 +424,7 @@ static int fdp_nci_patch_ram(struct nci_
+ {
+ struct fdp_nci_info *info = nci_get_drvdata(ndev);
+ struct device *dev = &info->phy->i2c_dev->dev;
+- u8 conn_id;
++ int conn_id;
+ int r = 0;
+
+ if (info->ram_version >= info->ram_patch_version)
--- /dev/null
+From ca857cc1d4cf17aba4bbb3b95d35454ad96924b3 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Tue, 28 Jun 2016 13:54:09 -0400
+Subject: NFS/pnfs: Do not clobber existing pgio_done_cb in nfs4_proc_read_setup
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit ca857cc1d4cf17aba4bbb3b95d35454ad96924b3 upstream.
+
+If a pNFS client sets hdr->pgio_done_cb, then we should not overwrite that
+in nfs4_proc_read_setup()
+
+Fixes: 75bf47ebf6b5 ("pNFS/flexfile: Fix erroneous fall back to...")
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4proc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -4393,7 +4393,8 @@ static void nfs4_proc_read_setup(struct
+ struct rpc_message *msg)
+ {
+ hdr->timestamp = jiffies;
+- hdr->pgio_done_cb = nfs4_read_done_cb;
++ if (!hdr->pgio_done_cb)
++ hdr->pgio_done_cb = nfs4_read_done_cb;
+ msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ];
+ nfs4_init_sequence(&hdr->args.seq_args, &hdr->res.seq_res, 0);
+ }
--- /dev/null
+From ad8d52b897a14711e026889053befbbee7fd51ba Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Wed, 31 Aug 2016 08:49:43 +0100
+Subject: pcmcia: ds: fix suspend/resume
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+commit ad8d52b897a14711e026889053befbbee7fd51ba upstream.
+
+PCMCIA suspend/resume no longer works since the commit mentioned below,
+as the callbacks are no longer made. Convert the driver to the new
+dev_pm_ops, which restores the suspend/resume functionality. Tested on
+the arm arch Assabet platform.
+
+Fixes: aa8e54b559479 ("PM / sleep: Go direct_complete if driver has no callbacks")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pcmcia/ds.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/pcmcia/ds.c
++++ b/drivers/pcmcia/ds.c
+@@ -977,7 +977,7 @@ static int pcmcia_bus_uevent(struct devi
+
+ /************************ runtime PM support ***************************/
+
+-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state);
++static int pcmcia_dev_suspend(struct device *dev);
+ static int pcmcia_dev_resume(struct device *dev);
+
+ static int runtime_suspend(struct device *dev)
+@@ -985,7 +985,7 @@ static int runtime_suspend(struct device
+ int rc;
+
+ device_lock(dev);
+- rc = pcmcia_dev_suspend(dev, PMSG_SUSPEND);
++ rc = pcmcia_dev_suspend(dev);
+ device_unlock(dev);
+ return rc;
+ }
+@@ -1135,7 +1135,7 @@ ATTRIBUTE_GROUPS(pcmcia_dev);
+
+ /* PM support, also needed for reset */
+
+-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state)
++static int pcmcia_dev_suspend(struct device *dev)
+ {
+ struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
+ struct pcmcia_driver *p_drv = NULL;
+@@ -1410,6 +1410,9 @@ static struct class_interface pcmcia_bus
+ .remove_dev = &pcmcia_bus_remove_socket,
+ };
+
++static const struct dev_pm_ops pcmcia_bus_pm_ops = {
++ SET_SYSTEM_SLEEP_PM_OPS(pcmcia_dev_suspend, pcmcia_dev_resume)
++};
+
+ struct bus_type pcmcia_bus_type = {
+ .name = "pcmcia",
+@@ -1418,8 +1421,7 @@ struct bus_type pcmcia_bus_type = {
+ .dev_groups = pcmcia_dev_groups,
+ .probe = pcmcia_device_probe,
+ .remove = pcmcia_device_remove,
+- .suspend = pcmcia_dev_suspend,
+- .resume = pcmcia_dev_resume,
++ .pm = &pcmcia_bus_pm_ops,
+ };
+
+
--- /dev/null
+From ae6c33ba6e37eea3012fe2640b22400ef3f2d0f3 Mon Sep 17 00:00:00 2001
+From: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
+Date: Thu, 25 Aug 2016 15:17:00 -0700
+Subject: printk: fix parsing of "brl=" option
+
+From: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
+
+commit ae6c33ba6e37eea3012fe2640b22400ef3f2d0f3 upstream.
+
+Commit bbeddf52adc1 ("printk: move braille console support into separate
+braille.[ch] files") moved the parsing of braille-related options into
+_braille_console_setup(), changing the type of variable str from char*
+to char**. In this commit, memcmp(str, "brl,", 4) was correctly updated
+to memcmp(*str, "brl,", 4) but not memcmp(str, "brl=", 4).
+
+Update the code to make "brl=" option work again and replace memcmp()
+with strncmp() to make the compiler able to detect such an issue.
+
+Fixes: bbeddf52adc1 ("printk: move braille console support into separate braille.[ch] files")
+Link: http://lkml.kernel.org/r/20160823165700.28952-1-nicolas.iooss_linux@m4x.org
+Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
+Cc: Joe Perches <joe@perches.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/printk/braille.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/printk/braille.c
++++ b/kernel/printk/braille.c
+@@ -9,10 +9,10 @@
+
+ char *_braille_console_setup(char **str, char **brl_options)
+ {
+- if (!memcmp(*str, "brl,", 4)) {
++ if (!strncmp(*str, "brl,", 4)) {
+ *brl_options = "";
+ *str += 4;
+- } else if (!memcmp(str, "brl=", 4)) {
++ } else if (!strncmp(*str, "brl=", 4)) {
+ *brl_options = *str + 4;
+ *str = strchr(*brl_options, ',');
+ if (!*str)
--- /dev/null
+From 52d210d961a62a9662e27f14d6505d6741b2fb02 Mon Sep 17 00:00:00 2001
+From: Geliang Tang <geliangtang@163.com>
+Date: Sat, 7 Nov 2015 12:43:49 +0800
+Subject: pstore: drop file opened reference count
+
+From: Geliang Tang <geliangtang@163.com>
+
+commit 52d210d961a62a9662e27f14d6505d6741b2fb02 upstream.
+
+In ee1d267423a1 ("pstore: add pstore unregister") I added:
+ .owner = THIS_MODULE,
+in both pstore_fs_type and pstore_file_operations to increase a reference
+count when pstore filesystem is mounted and pstore file is opened.
+
+But, it's repetitive. There is no need to increase the opened reference
+count. We only need to increase the mounted reference count. When a file
+is opened, the filesystem can't be unmounted. Hence the pstore module
+can't be unloaded either.
+
+So I drop the opened reference count in this patch.
+
+Fixes: ee1d267423a1 ("pstore: add pstore unregister")
+Signed-off-by: Geliang Tang <geliangtang@163.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/pstore/inode.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/pstore/inode.c
++++ b/fs/pstore/inode.c
+@@ -178,7 +178,6 @@ static loff_t pstore_file_llseek(struct
+ }
+
+ static const struct file_operations pstore_file_operations = {
+- .owner = THIS_MODULE,
+ .open = pstore_file_open,
+ .read = pstore_file_read,
+ .llseek = pstore_file_llseek,
--- /dev/null
+From 061b5c3c48a1e276f8fd539bfa8aab8b359ffc31 Mon Sep 17 00:00:00 2001
+From: Sawan Chandak <sawan.chandak@qlogic.com>
+Date: Wed, 6 Jul 2016 11:14:34 -0400
+Subject: qla2xxx: Fix BBCR offset
+
+From: Sawan Chandak <sawan.chandak@qlogic.com>
+
+commit 061b5c3c48a1e276f8fd539bfa8aab8b359ffc31 upstream.
+
+Fixes: 969a619 ("qla2xxx: Add support for buffer to buffer credit value for ISP27XX.")
+Signed-off-by: Sawan Chandak <sawan.chandak@qlogic.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_fw.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/qla2xxx/qla_fw.h
++++ b/drivers/scsi/qla2xxx/qla_fw.h
+@@ -1288,7 +1288,7 @@ struct vp_rpt_id_entry_24xx {
+
+ uint8_t vp_idx_map[16];
+
+- uint8_t reserved_4[28];
++ uint8_t reserved_4[24];
+ uint16_t bbcr;
+ uint8_t reserved_5[6];
+ };
--- /dev/null
+From c2588393e6315ab68207323d37d2a73713d6bc81 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Wed, 6 Jul 2016 11:42:01 -0700
+Subject: regulator: pwm: Fix regulator ramp delay for continuous mode
+
+From: Douglas Anderson <dianders@chromium.org>
+
+commit c2588393e6315ab68207323d37d2a73713d6bc81 upstream.
+
+The original commit adding support for continuous voltage mode didn't
+handle the regulator ramp delay properly. It treated the delay as a
+fixed delay in uS despite the property being defined as uV / uS. Let's
+adjust it. Luckily there appear to be no users of this ramp delay for
+PWM regulators (as per grepping through device trees in linuxnext).
+
+Note also that the upper bound of usleep_range probably shouldn't be a
+full 1 ms longer than the lower bound since I've seen plenty of hardware
+with a ramp rate of ~5000 uS / uV and for small jumps the total delays
+are in the tens of uS. 1000 is way too much. We'll try to be dynamic
+and use 10%.
+
+NOTE: This commit doesn't add support for regulator-enable-ramp-delay.
+That could be done in a future patch when someone has a user of that
+featre.
+
+Though this patch is shows as "fixing" a bug, there are no actual known
+users of continuous mode PWM regulator w/ ramp delay in mainline and so
+this likely won't have any effect on anyone unless they are working
+out-of-tree with private patches. For anyone in this state, it is
+highly encouraged to also pick Boris Brezillon's WIP patches to get
+yourself a reliable and glitch-free regulator.
+
+Fixes: 4773be185a0f ("regulator: pwm-regulator: Add support for continuous-voltage")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Laxman Dewangan <ldewangan@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/pwm-regulator.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/regulator/pwm-regulator.c
++++ b/drivers/regulator/pwm-regulator.c
+@@ -132,6 +132,7 @@ static int pwm_regulator_set_voltage(str
+ unsigned int duty_pulse;
+ u64 req_period;
+ u32 rem;
++ int old_uV = pwm_regulator_get_voltage(rdev);
+ int ret;
+
+ pwm_get_args(drvdata->pwm, &pargs);
+@@ -166,8 +167,12 @@ static int pwm_regulator_set_voltage(str
+ }
+ drvdata->volt_uV = min_uV;
+
+- /* Delay required by PWM regulator to settle to the new voltage */
+- usleep_range(ramp_delay, ramp_delay + 1000);
++ if ((ramp_delay == 0) || !pwm_regulator_is_enabled(rdev))
++ return 0;
++
++ /* Ramp delay is in uV/uS. Adjust to uS and delay */
++ ramp_delay = DIV_ROUND_UP(abs(min_uV - old_uV), ramp_delay);
++ usleep_range(ramp_delay, ramp_delay + DIV_ROUND_UP(ramp_delay, 10));
+
+ return 0;
+ }
--- /dev/null
+From 290284776bb281759b11faa287b8abccaf74bfcb Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Mon, 11 Jul 2016 14:50:07 -0700
+Subject: regulator: qcom_smd: Fix voltage ranges for pm8x41
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+commit 290284776bb281759b11faa287b8abccaf74bfcb upstream.
+
+The voltage ranges listed here are wrong. The correct ranges can
+be seen in the "native" spmi regulator driver
+qcom_spmi-regulator.c at pldo_ranges[], ftsmps_ranges[] and
+boost_ranges[] for the pldo, ftsmps, and boost type regulators.
+Port these ranges over to the RPM SMD regulator driver so that we
+list the appropriate set of supported voltages on pldos.
+
+Doing this allows us to specify a voltage like 3075000 for l24,
+whereas before that wasn't a supported voltage.
+
+Fixes: da65e367b67e ("regulator: Regulator driver for the Qualcomm RPM")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Reviewed-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/qcom_smd-regulator.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -221,29 +221,30 @@ static const struct regulator_desc pm8x4
+ static const struct regulator_desc pm8841_ftsmps = {
+ .linear_ranges = (struct regulator_linear_range[]) {
+ REGULATOR_LINEAR_RANGE(350000, 0, 184, 5000),
+- REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
++ REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
+ },
+ .n_linear_ranges = 2,
+- .n_voltages = 340,
++ .n_voltages = 262,
+ .ops = &rpm_smps_ldo_ops,
+ };
+
+ static const struct regulator_desc pm8941_boost = {
+ .linear_ranges = (struct regulator_linear_range[]) {
+- REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
++ REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
+ },
+ .n_linear_ranges = 1,
+- .n_voltages = 16,
++ .n_voltages = 31,
+ .ops = &rpm_smps_ldo_ops,
+ };
+
+ static const struct regulator_desc pm8941_pldo = {
+ .linear_ranges = (struct regulator_linear_range[]) {
+- REGULATOR_LINEAR_RANGE( 750000, 0, 30, 25000),
+- REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
++ REGULATOR_LINEAR_RANGE( 750000, 0, 63, 12500),
++ REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
++ REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
+ },
+- .n_linear_ranges = 2,
+- .n_voltages = 100,
++ .n_linear_ranges = 3,
++ .n_voltages = 164,
+ .ops = &rpm_smps_ldo_ops,
+ };
+
--- /dev/null
+From c488f0071eacd10a290df4fb34bbdeb4eb8e7888 Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Mon, 11 Jul 2016 14:50:08 -0700
+Subject: regulator: qcom_smd: Fix voltage ranges for pma8084 ftsmps and pldo
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+commit c488f0071eacd10a290df4fb34bbdeb4eb8e7888 upstream.
+
+The voltage ranges listed here are wrong. The pma8084 pldo
+supports three different overlapping voltage ranges with
+differing step sizes and the pma8084 ftsmps supports two. These
+ranges can be seen in the "native" spmi regulator driver
+(qcom_spmi-regulator.c) at pldo_ranges[] and ftsmps_ranges[]
+respectively. Port these ranges over to the RPM SMD regulator
+driver so that we list the appropriate set of supported voltages
+on these types of regulators.
+
+Fixes: ee01d0c91ef1 ("regulator: qcom-smd: Add support for PMA8084")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Reviewed-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/qcom_smd-regulator.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -178,20 +178,21 @@ static const struct regulator_desc pma80
+ static const struct regulator_desc pma8084_ftsmps = {
+ .linear_ranges = (struct regulator_linear_range[]) {
+ REGULATOR_LINEAR_RANGE(350000, 0, 184, 5000),
+- REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
++ REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
+ },
+ .n_linear_ranges = 2,
+- .n_voltages = 340,
++ .n_voltages = 262,
+ .ops = &rpm_smps_ldo_ops,
+ };
+
+ static const struct regulator_desc pma8084_pldo = {
+ .linear_ranges = (struct regulator_linear_range[]) {
+- REGULATOR_LINEAR_RANGE(750000, 0, 30, 25000),
+- REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
++ REGULATOR_LINEAR_RANGE( 750000, 0, 63, 12500),
++ REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
++ REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
+ },
+- .n_linear_ranges = 2,
+- .n_voltages = 100,
++ .n_linear_ranges = 3,
++ .n_voltages = 164,
+ .ops = &rpm_smps_ldo_ops,
+ };
+
--- /dev/null
+From 919163f6362ac23138d31fc8befdd52e5d7e488d Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <stephen.boyd@linaro.org>
+Date: Sat, 25 Jun 2016 22:52:13 -0700
+Subject: regulator: qcom_spmi: Add support for get_mode/set_mode on switches
+
+From: Stephen Boyd <stephen.boyd@linaro.org>
+
+commit 919163f6362ac23138d31fc8befdd52e5d7e488d upstream.
+
+The voltage switches support mode switching, so add support for
+these ops to those types of regulators.
+
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Fixes: e92a4047419c ("regulator: Add QCOM SPMI regulator driver")
+Signed-off-by: Stephen Boyd <stephen.boyd@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/qcom_spmi-regulator.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/regulator/qcom_spmi-regulator.c
++++ b/drivers/regulator/qcom_spmi-regulator.c
+@@ -1085,6 +1085,8 @@ static struct regulator_ops spmi_vs_ops
+ .set_pull_down = spmi_regulator_common_set_pull_down,
+ .set_soft_start = spmi_regulator_common_set_soft_start,
+ .set_over_current_protection = spmi_regulator_vs_ocp,
++ .set_mode = spmi_regulator_common_set_mode,
++ .get_mode = spmi_regulator_common_get_mode,
+ };
+
+ static struct regulator_ops spmi_boost_ops = {
--- /dev/null
+From c333dfe8dba7d3e47e97e1cee3c38123e19ae73c Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <stephen.boyd@linaro.org>
+Date: Sat, 25 Jun 2016 22:52:11 -0700
+Subject: regulator: qcom_spmi: Add support for S4 supply on pm8941
+
+From: Stephen Boyd <stephen.boyd@linaro.org>
+
+commit c333dfe8dba7d3e47e97e1cee3c38123e19ae73c upstream.
+
+The S4 supply is sometimes called the boost regulator because it
+outputs 5V. Typically it's connected to the 5vs1 and 5vs2
+switches for use in USB OTG and HDMI applications. Add support
+for this regulator which was mistakenly left out from the initial
+submission of this driver.
+
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Fixes: e92a4047419c ("regulator: Add QCOM SPMI regulator driver")
+Signed-off-by: Stephen Boyd <stephen.boyd@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt | 4 ++--
+ drivers/regulator/qcom_spmi-regulator.c | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
++++ b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
+@@ -113,8 +113,8 @@ pm8916:
+ l14, l15, l16, l17, l18
+
+ pm8941:
+- s1, s2, s3, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13, l14,
+- l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
++ s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13,
++ l14, l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
+ mvs1, mvs2
+
+ pm8994:
+--- a/drivers/regulator/qcom_spmi-regulator.c
++++ b/drivers/regulator/qcom_spmi-regulator.c
+@@ -1496,6 +1496,7 @@ static const struct spmi_regulator_data
+ { "s1", 0x1400, "vdd_s1", },
+ { "s2", 0x1700, "vdd_s2", },
+ { "s3", 0x1a00, "vdd_s3", },
++ { "s4", 0xa000, },
+ { "l1", 0x4000, "vdd_l1_l3", },
+ { "l2", 0x4100, "vdd_l2_lvs_1_2_3", },
+ { "l3", 0x4200, "vdd_l1_l3", },
--- /dev/null
+From 93bfe79b03365f410aa91caf04263173c008ecdf Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <stephen.boyd@linaro.org>
+Date: Sat, 25 Jun 2016 22:52:12 -0700
+Subject: regulator: qcom_spmi: Update mvs1/mvs2 switches on pm8941
+
+From: Stephen Boyd <stephen.boyd@linaro.org>
+
+commit 93bfe79b03365f410aa91caf04263173c008ecdf upstream.
+
+The mvs1 and mvs2 switches are actually called 5vs1 and 5vs2 on
+some datasheets. Let's rename them to match the datasheets and
+also match the RPM based regulator driver which calls these by
+their 5vs names (see qcom_smd-regulator.c). There aren't any
+users of these regulators so far, so there aren't any concerns of
+DT ABI breakage here. While we're here making updates to the
+switches, also mandate usage of the OCP irq for these switches
+too.
+
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Fixes: e92a4047419c ("regulator: Add QCOM SPMI regulator driver")
+Signed-off-by: Stephen Boyd <stephen.boyd@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt | 2 +-
+ drivers/regulator/qcom_spmi-regulator.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
++++ b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
+@@ -115,7 +115,7 @@ pm8916:
+ pm8941:
+ s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13,
+ l14, l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
+- mvs1, mvs2
++ 5vs1, 5vs2
+
+ pm8994:
+ s1, s2, s3, s4, s5, s6, s7, s8, s9, s10, s11, s12, l1, l2, l3, l4, l5,
+--- a/drivers/regulator/qcom_spmi-regulator.c
++++ b/drivers/regulator/qcom_spmi-regulator.c
+@@ -1526,8 +1526,8 @@ static const struct spmi_regulator_data
+ { "lvs1", 0x8000, "vdd_l2_lvs_1_2_3", },
+ { "lvs2", 0x8100, "vdd_l2_lvs_1_2_3", },
+ { "lvs3", 0x8200, "vdd_l2_lvs_1_2_3", },
+- { "mvs1", 0x8300, "vin_5vs", },
+- { "mvs2", 0x8400, "vin_5vs", },
++ { "5vs1", 0x8300, "vin_5vs", "ocp-5vs1", },
++ { "5vs2", 0x8400, "vin_5vs", "ocp-5vs2", },
+ { }
+ };
+
mips-fix-uretprobe-implementation.patch
mips-malta-fix-iocu-disable-switch-read-for-mips64.patch
mips-uprobes-fix-use-of-uninitialised-variable.patch
+printk-fix-parsing-of-brl-option.patch
+bluetooth-split-sk_filter-in-l2cap_sock_recv_cb.patch
+lib-test_hash.c-fix-warning-in-two-dimensional-array-init.patch
+tpm-fix-byte-order-for-the-value-read-by-tpm2_get_tpm_pt.patch
+regulator-pwm-fix-regulator-ramp-delay-for-continuous-mode.patch
+regulator-qcom_spmi-add-support-for-s4-supply-on-pm8941.patch
+regulator-qcom_spmi-add-support-for-get_mode-set_mode-on-switches.patch
+regulator-qcom_spmi-update-mvs1-mvs2-switches-on-pm8941.patch
+regulator-qcom_smd-fix-voltage-ranges-for-pm8x41.patch
+regulator-qcom_smd-fix-voltage-ranges-for-pma8084-ftsmps-and-pldo.patch
+arm-dts-imx6sx-sabreauto-fix-misspelled-property.patch
+arm-sun5i-fix-typo-in-trip-point-temperature.patch
+arm-sa1100-register-clocks-early.patch
+arm-sa1100-fix-3.6864mhz-clock.patch
+arm-sa1100-clear-reset-status-prior-to-reboot.patch
+arm-shmobile-fix-regulator-quirk-for-gen2.patch
+arm-sa1111-fix-pcmcia-suspend-resume.patch
+pcmcia-ds-fix-suspend-resume.patch
+hwrng-omap-fix-assumption-that-runtime_get_sync-will-always-succeed.patch
+blk-mq-actually-hook-up-defer-list-when-running-requests.patch
+pstore-drop-file-opened-reference-count.patch
+tile-define-at_vector_size_arch-for-arch_dlinfo.patch
+fm10k-fix-incorrect-index-calculation-in-fm10k_write_reta.patch
+iwlmvm-mvm-set-correct-state-in-smart-fifo-configuration.patch
+nfc-fdp-detect-errors-from-fdp_nci_create_conn.patch
+em28xx-i2c-rt_mutex_trylock-returns-zero-on-failure.patch
+v4l-vsp1-fix-crash-when-resetting-pipeline.patch
+gspca-avoid-unused-variable-warnings.patch
+ath9k-fix-programming-of-mincca-power-threshold.patch
+mailbox-mailbox-test-set-tdev-signal-to-null-after-freeing.patch
+avr32-off-by-one-in-at32_init_pio.patch
+qla2xxx-fix-bbcr-offset.patch
+fnic-pci_dma_mapping_error-doesn-t-return-an-error-code.patch
+mm-kasan-account-for-object-redzone-in-slub-s-nearest_obj.patch
+tracing-have-hist_triggers-select-tracing.patch
+dmaengine-bcm2835-fix-64-bit-warning.patch
+dmaengine-at_xdmac-fix-debug-string.patch
+nfs-pnfs-do-not-clobber-existing-pgio_done_cb-in-nfs4_proc_read_setup.patch
--- /dev/null
+From cdf8b4633075f2171d440d2e37c9c2609019a81a Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Mon, 25 Jul 2016 16:59:54 +0100
+Subject: tile: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit cdf8b4633075f2171d440d2e37c9c2609019a81a upstream.
+
+AT_VECTOR_SIZE_ARCH should be defined with the maximum number of
+NEW_AUX_ENT entries that ARCH_DLINFO can contain, but it wasn't defined
+for tile at all even though ARCH_DLINFO will contain one NEW_AUX_ENT for
+the VDSO address.
+
+This shouldn't be a problem as AT_VECTOR_SIZE_BASE includes space for
+AT_BASE_PLATFORM which tile doesn't use, but lets define it now and add
+the comment above ARCH_DLINFO as found in several other architectures to
+remind future modifiers of ARCH_DLINFO to keep AT_VECTOR_SIZE_ARCH up to
+date.
+
+Fixes: 4a556f4f56da ("tile: implement gettimeofday() via vDSO")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Chris Metcalf <cmetcalf@mellanox.com>
+Signed-off-by: Chris Metcalf <cmetcalf@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/tile/include/asm/elf.h | 1 +
+ arch/tile/include/uapi/asm/auxvec.h | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/arch/tile/include/asm/elf.h
++++ b/arch/tile/include/asm/elf.h
+@@ -129,6 +129,7 @@ extern int dump_task_regs(struct task_st
+ struct linux_binprm;
+ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
+ int executable_stack);
++/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
+ #define ARCH_DLINFO \
+ do { \
+ NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
+--- a/arch/tile/include/uapi/asm/auxvec.h
++++ b/arch/tile/include/uapi/asm/auxvec.h
+@@ -18,4 +18,6 @@
+ /* The vDSO location. */
+ #define AT_SYSINFO_EHDR 33
+
++#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
++
+ #endif /* _ASM_TILE_AUXVEC_H */
--- /dev/null
+From 1b0612b04090e416828c0dd5ed197b0913d834a0 Mon Sep 17 00:00:00 2001
+From: "apronin@chromium.org" <apronin@chromium.org>
+Date: Thu, 14 Jul 2016 18:07:18 -0700
+Subject: tpm: fix byte-order for the value read by tpm2_get_tpm_pt
+
+From: apronin@chromium.org <apronin@chromium.org>
+
+commit 1b0612b04090e416828c0dd5ed197b0913d834a0 upstream.
+
+The result must be converted from BE byte order, which is used by the
+TPM2 protocol. This has not popped out because tpm2_get_tpm_pt() has
+been only used for probing.
+
+Fixes: 7a1d7e6dd76a ("tpm: TPM 2.0 baseline support")
+Change-Id: I7d71cd379b1a3b7659d20a1b6008216762596590
+Signed-off-by: Andrey Pronin <apronin@chromium.org>
+Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
+Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/tpm/tpm2-cmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -703,7 +703,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip
+
+ rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), desc);
+ if (!rc)
+- *value = cmd.params.get_tpm_pt_out.value;
++ *value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
+
+ return rc;
+ }
--- /dev/null
+From 7ad8fb61c4abf589596f0a4da34d987471481569 Mon Sep 17 00:00:00 2001
+From: Tom Zanussi <tom.zanussi@linux.intel.com>
+Date: Sun, 3 Jul 2016 08:51:34 -0500
+Subject: tracing: Have HIST_TRIGGERS select TRACING
+
+From: Tom Zanussi <tom.zanussi@linux.intel.com>
+
+commit 7ad8fb61c4abf589596f0a4da34d987471481569 upstream.
+
+The kbuild test robot reported a compile error if HIST_TRIGGERS was
+enabled but nothing else that selected TRACING was configured in.
+
+HIST_TRIGGERS should directly select it and not rely on anything else
+to do it.
+
+Link: http://lkml.kernel.org/r/57791866.8080505@linux.intel.com
+
+Reported-by: kbuild test robot <fennguang.wu@intel.com>
+Fixes: 7ef224d1d0e3a ("tracing: Add 'hist' event trigger command")
+Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/trace/Kconfig
++++ b/kernel/trace/Kconfig
+@@ -542,6 +542,7 @@ config HIST_TRIGGERS
+ bool "Histogram triggers"
+ depends on ARCH_HAVE_NMI_SAFE_CMPXCHG
+ select TRACING_MAP
++ select TRACING
+ default n
+ help
+ Hist triggers allow one or more arbitrary trace event fields
--- /dev/null
+From d69e40fade97b6b19837c1772efa516bc28cc870 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Wed, 18 May 2016 20:01:21 -0300
+Subject: [media] v4l: vsp1: Fix crash when resetting pipeline
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+commit d69e40fade97b6b19837c1772efa516bc28cc870 upstream.
+
+The vsp1_pipeline_reset() function loops over pipeline inputs and output
+and resets them. When doing so it assumes both that the pipeline has
+been correctly configured with an output, and that inputs are are stored
+in the pipe inputs array at positions 0 to num_inputs-1.
+
+Both the assumptions are incorrect. The pipeline might need to be reset
+after a failed attempts to configure it, without any output specified.
+Furthermore, inputs are stored in a positiong equal to their RPF index,
+possibly creating holes in the inputs array if the RPFs are not used in
+sequence.
+
+Fix both issues by looping over the whole inputs array and skipping
+unused entries, and ignoring the output when not set.
+
+Fixes: ff7e97c94d9f ("[media] v4l: vsp1: Store pipeline pointer in rwpf")
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/vsp1/vsp1_pipe.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/platform/vsp1/vsp1_pipe.c
++++ b/drivers/media/platform/vsp1/vsp1_pipe.c
+@@ -172,13 +172,17 @@ void vsp1_pipeline_reset(struct vsp1_pip
+ bru->inputs[i].rpf = NULL;
+ }
+
+- for (i = 0; i < pipe->num_inputs; ++i) {
+- pipe->inputs[i]->pipe = NULL;
+- pipe->inputs[i] = NULL;
++ for (i = 0; i < ARRAY_SIZE(pipe->inputs); ++i) {
++ if (pipe->inputs[i]) {
++ pipe->inputs[i]->pipe = NULL;
++ pipe->inputs[i] = NULL;
++ }
+ }
+
+- pipe->output->pipe = NULL;
+- pipe->output = NULL;
++ if (pipe->output) {
++ pipe->output->pipe = NULL;
++ pipe->output = NULL;
++ }
+
+ INIT_LIST_HEAD(&pipe->entities);
+ pipe->state = VSP1_PIPELINE_STOPPED;
projects / thirdparty / kernel / stable-queue.git / commitdiff
