--- /dev/null
+From 624531886987f0f1b5d01fb598034d039198e090 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Tue, 7 Jun 2016 17:57:54 +0100
+Subject: ARM: 8578/1: mm: ensure pmd_present only checks the valid bit
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit 624531886987f0f1b5d01fb598034d039198e090 upstream.
+
+In a subsequent patch, pmd_mknotpresent will clear the valid bit of the
+pmd entry, resulting in a not-present entry from the hardware's
+perspective. Unfortunately, pmd_present simply checks for a non-zero pmd
+value and will therefore continue to return true even after a
+pmd_mknotpresent operation. Since pmd_mknotpresent is only used for
+managing huge entries, this is only an issue for the 3-level case.
+
+This patch fixes the 3-level pmd_present implementation to take into
+account the valid bit. For bisectability, the change is made before the
+fix to pmd_mknotpresent.
+
+[catalin.marinas@arm.com: comment update regarding pmd_mknotpresent patch]
+
+Fixes: 8d9625070073 ("ARM: mm: Transparent huge page support for LPAE systems.")
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: Steve Capper <Steve.Capper@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/pgtable-2level.h | 1 +
+ arch/arm/include/asm/pgtable-3level.h | 1 +
+ arch/arm/include/asm/pgtable.h | 1 -
+ 3 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/include/asm/pgtable-2level.h
++++ b/arch/arm/include/asm/pgtable-2level.h
+@@ -193,6 +193,7 @@ static inline pmd_t *pmd_offset(pud_t *p
+
+ #define pmd_large(pmd) (pmd_val(pmd) & 2)
+ #define pmd_bad(pmd) (pmd_val(pmd) & 2)
++#define pmd_present(pmd) (pmd_val(pmd))
+
+ #define copy_pmd(pmdpd,pmdps) \
+ do { \
+--- a/arch/arm/include/asm/pgtable-3level.h
++++ b/arch/arm/include/asm/pgtable-3level.h
+@@ -211,6 +211,7 @@ static inline pmd_t *pmd_offset(pud_t *p
+ : !!(pmd_val(pmd) & (val)))
+ #define pmd_isclear(pmd, val) (!(pmd_val(pmd) & (val)))
+
++#define pmd_present(pmd) (pmd_isset((pmd), L_PMD_SECT_VALID))
+ #define pmd_young(pmd) (pmd_isset((pmd), PMD_SECT_AF))
+ #define pte_special(pte) (pte_isset((pte), L_PTE_SPECIAL))
+ static inline pte_t pte_mkspecial(pte_t pte)
+--- a/arch/arm/include/asm/pgtable.h
++++ b/arch/arm/include/asm/pgtable.h
+@@ -182,7 +182,6 @@ extern pgd_t swapper_pg_dir[PTRS_PER_PGD
+ #define pgd_offset_k(addr) pgd_offset(&init_mm, addr)
+
+ #define pmd_none(pmd) (!pmd_val(pmd))
+-#define pmd_present(pmd) (pmd_val(pmd))
+
+ static inline pte_t *pmd_page_vaddr(pmd_t pmd)
+ {
--- /dev/null
+From 56530f5d2ddc9b9fade7ef8db9cb886e9dc689b5 Mon Sep 17 00:00:00 2001
+From: Steve Capper <steve.capper@arm.com>
+Date: Tue, 7 Jun 2016 17:58:06 +0100
+Subject: ARM: 8579/1: mm: Fix definition of pmd_mknotpresent
+
+From: Steve Capper <steve.capper@arm.com>
+
+commit 56530f5d2ddc9b9fade7ef8db9cb886e9dc689b5 upstream.
+
+Currently pmd_mknotpresent will use a zero entry to respresent an
+invalidated pmd.
+
+Unfortunately this definition clashes with pmd_none, thus it is
+possible for a race condition to occur if zap_pmd_range sees pmd_none
+whilst __split_huge_pmd_locked is running too with pmdp_invalidate
+just called.
+
+This patch fixes the race condition by modifying pmd_mknotpresent to
+create non-zero faulting entries (as is done in other architectures),
+removing the ambiguity with pmd_none.
+
+[catalin.marinas@arm.com: using L_PMD_SECT_VALID instead of PMD_TYPE_SECT]
+
+Fixes: 8d9625070073 ("ARM: mm: Transparent huge page support for LPAE systems.")
+Reported-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Cc: Russell King <linux@armlinux.org.uk>
+Signed-off-by: Steve Capper <steve.capper@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/include/asm/pgtable-3level.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/include/asm/pgtable-3level.h
++++ b/arch/arm/include/asm/pgtable-3level.h
+@@ -250,10 +250,10 @@ PMD_BIT_FUNC(mkyoung, |= PMD_SECT_AF);
+ #define pfn_pmd(pfn,prot) (__pmd(((phys_addr_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
+ #define mk_pmd(page,prot) pfn_pmd(page_to_pfn(page),prot)
+
+-/* represent a notpresent pmd by zero, this is used by pmdp_invalidate */
++/* represent a notpresent pmd by faulting entry, this is used by pmdp_invalidate */
+ static inline pmd_t pmd_mknotpresent(pmd_t pmd)
+ {
+- return __pmd(0);
++ return __pmd(pmd_val(pmd) & ~L_PMD_SECT_VALID);
+ }
+
+ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot)
--- /dev/null
+From cb84f6c0a25eb76b1f838eb63e212705c0c06b5f Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Wed, 11 May 2016 13:23:13 +0800
+Subject: ARM: dts: sun6i: primo81: Drop constraints on dc1sw regulator
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit cb84f6c0a25eb76b1f838eb63e212705c0c06b5f upstream.
+
+This is the same issue fixed in commit dcf5341f0150 ("ARM: dts:
+sun8i-q8-common: Do not set constraints on dc1sw regulator").
+Commit message copied:
+
+dc1sw is an on/off only regulator and as such it cannot have constraints.
+
+This is a limitation of the kernel regulator implementation which resolves
+supplies on the first regulator_get(), which is done after applying
+constraints, and applying the constrains will fail because it calls
+_regulator_get_voltage() and _regulator_do_set_voltage() both of which
+will fail on a switch regulator when there is no supply (yet).
+
+This causes registering of all axp22x regulators to fail with the
+following errors:
+
+[ 1.395249] vcc-lcd: failed to get the current voltage(-22)
+[ 1.405131] axp20x-regulator axp20x-regulator: Failed to register dc1sw
+[ 1.412436] axp20x-regulator: probe of axp20x-regulator failed with error -22
+
+This commit removes the constrains on dc1sw / vcc-lcd fixing this problem.
+Note that dcdc1 itself is contrained to the exact same values, so this
+does not change anything.
+
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/sun6i-a31s-primo81.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/arm/boot/dts/sun6i-a31s-primo81.dts
++++ b/arch/arm/boot/dts/sun6i-a31s-primo81.dts
+@@ -176,8 +176,6 @@
+ };
+
+ ®_dc1sw {
+- regulator-min-microvolt = <3000000>;
+- regulator-max-microvolt = <3000000>;
+ regulator-name = "vcc-lcd";
+ };
+
--- /dev/null
+From b223d6242c372a81cca3bb81998f53d3b3e3fb70 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Wed, 11 May 2016 13:23:14 +0800
+Subject: ARM: dts: sun6i: yones-toptech-bs1078-v2: Drop constraints on dc1sw regulator
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit b223d6242c372a81cca3bb81998f53d3b3e3fb70 upstream.
+
+This is the same issue fixed in commit dcf5341f0150 ("ARM: dts:
+sun8i-q8-common: Do not set constraints on dc1sw regulator").
+Commit message copied:
+
+dc1sw is an on/off only regulator and as such it cannot have constraints.
+
+This is a limitation of the kernel regulator implementation which resolves
+supplies on the first regulator_get(), which is done after applying
+constraints, and applying the constrains will fail because it calls
+_regulator_get_voltage() and _regulator_do_set_voltage() both of which
+will fail on a switch regulator when there is no supply (yet).
+
+This causes registering of all axp22x regulators to fail with the
+following errors:
+
+[ 1.395249] vcc-lcd: failed to get the current voltage(-22)
+[ 1.405131] axp20x-regulator axp20x-regulator: Failed to register dc1sw
+[ 1.412436] axp20x-regulator: probe of axp20x-regulator failed with error -22
+
+This commit removes the constrains on dc1sw / vcc-lcd fixing this problem.
+Note that dcdc1 itself is contrained to the exact same values, so this
+does not change anything.
+
+Cc: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts
++++ b/arch/arm/boot/dts/sun6i-a31s-yones-toptech-bs1078-v2.dts
+@@ -135,8 +135,6 @@
+
+ ®_dc1sw {
+ regulator-name = "vcc-lcd-usb2";
+- regulator-min-microvolt = <3000000>;
+- regulator-max-microvolt = <3000000>;
+ };
+
+ ®_dc5ldo {
--- /dev/null
+From 20c15226d1c73150c4d9107301cac5dda0b7f995 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@nxp.com>
+Date: Wed, 11 May 2016 16:39:30 -0300
+Subject: ARM: imx6ul: Fix Micrel PHY mask
+
+From: Fabio Estevam <fabio.estevam@nxp.com>
+
+commit 20c15226d1c73150c4d9107301cac5dda0b7f995 upstream.
+
+The value used for Micrel PHY mask is not correct. Use the
+MICREL_PHY_ID_MASK definition instead.
+
+Thanks to Jiri Luznicky for proposing the fix at
+https://community.freescale.com/thread/387739
+
+Fixes: 709bc0657fe6f9f55 ("ARM: imx6ul: add fec MAC refrence clock and phy fixup init")
+Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/mach-imx6ul.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-imx/mach-imx6ul.c
++++ b/arch/arm/mach-imx/mach-imx6ul.c
+@@ -46,7 +46,7 @@ static int ksz8081_phy_fixup(struct phy_
+ static void __init imx6ul_enet_phy_init(void)
+ {
+ if (IS_BUILTIN(CONFIG_PHYLIB))
+- phy_register_fixup_for_uid(PHY_ID_KSZ8081, 0xffffffff,
++ phy_register_fixup_for_uid(PHY_ID_KSZ8081, MICREL_PHY_ID_MASK,
+ ksz8081_phy_fixup);
+ }
+
--- /dev/null
+From 4b2312bd0592708c85ed94368c874819e7013309 Mon Sep 17 00:00:00 2001
+From: Harvey Hunt <harvey.hunt@imgtec.com>
+Date: Mon, 23 May 2016 12:05:52 +0100
+Subject: irqchip/mips-gic: Fix IRQs in gic_dev_domain
+
+From: Harvey Hunt <harvey.hunt@imgtec.com>
+
+commit 4b2312bd0592708c85ed94368c874819e7013309 upstream.
+
+When allocating a new device IRQ, gic_dev_domain_alloc() correctly calls
+irq_domain_set_hwirq_and_chip(), but gic_irq_domain_alloc() does not. This
+means that gic_irq_domain believes all IRQs from the dev domain have an
+hwirq of 0 and creates incorrect mappings in the linear_revmap. As
+gic_irq_domain is a parent of the gic_dev_domain, this leads to an
+inability to boot on devices with a GIC. Excerpt of the error:
+
+[ 2.297649] irq 0: nobody cared (try booting with the "irqpoll" option)
+...
+[ 2.436963] handlers:
+[ 2.439492] Disabling IRQ #0
+
+Fix this by calling irq_domain_set_hwirq_and_chip() for both the dev and
+irq domain.
+
+Now that we are modifying the parent domain, be sure to clear it up in
+case of an allocation error.
+
+Fixes: c98c1822ee13 ("irqchip/mips-gic: Add device hierarchy domain")
+Fixes: 2af70a962070 ("irqchip/mips-gic: Add a IPI hierarchy domain")
+Signed-off-by: Harvey Hunt <harvey.hunt@imgtec.com>
+Tested-by: Govindraj Raja <Govindraj.Raja@imgtec.com> # On Pistachio SoC
+Reviewed-by: Matt Redfearn <matt.redfearn@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Cc: Qais Yousef <qsyousef@gmail.com>
+Cc: jason@lakedaemon.net
+Cc: marc.zyngier@arm.com
+Link: http://lkml.kernel.org/r/1464001552-31174-1-git-send-email-harvey.hunt@imgtec.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-mips-gic.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-mips-gic.c
++++ b/drivers/irqchip/irq-mips-gic.c
+@@ -734,6 +734,12 @@ static int gic_irq_domain_alloc(struct i
+ /* verify that it doesn't conflict with an IPI irq */
+ if (test_bit(spec->hwirq, ipi_resrv))
+ return -EBUSY;
++
++ hwirq = GIC_SHARED_TO_HWIRQ(spec->hwirq);
++
++ return irq_domain_set_hwirq_and_chip(d, virq, hwirq,
++ &gic_level_irq_controller,
++ NULL);
+ } else {
+ base_hwirq = find_first_bit(ipi_resrv, gic_shared_intrs);
+ if (base_hwirq == gic_shared_intrs) {
+@@ -855,10 +861,14 @@ static int gic_dev_domain_alloc(struct i
+ &gic_level_irq_controller,
+ NULL);
+ if (ret)
+- return ret;
++ goto error;
+ }
+
+ return 0;
++
++error:
++ irq_domain_free_irqs_parent(d, virq, nr_irqs);
++ return ret;
+ }
+
+ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
--- /dev/null
+From 797179bc4fe06c89e47a9f36f886f68640b423f8 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Thu, 9 Jun 2016 10:50:43 +0100
+Subject: MIPS: KVM: Fix modular KVM under QEMU
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 797179bc4fe06c89e47a9f36f886f68640b423f8 upstream.
+
+Copy __kvm_mips_vcpu_run() into unmapped memory, so that we can never
+get a TLB refill exception in it when KVM is built as a module.
+
+This was observed to happen with the host MIPS kernel running under
+QEMU, due to a not entirely transparent optimisation in the QEMU TLB
+handling where TLB entries replaced with TLBWR are copied to a separate
+part of the TLB array. Code in those pages continue to be executable,
+but those mappings persist only until the next ASID switch, even if they
+are marked global.
+
+An ASID switch happens in __kvm_mips_vcpu_run() at exception level after
+switching to the guest exception base. Subsequent TLB mapped kernel
+instructions just prior to switching to the guest trigger a TLB refill
+exception, which enters the guest exception handlers without updating
+EPC. This appears as a guest triggered TLB refill on a host kernel
+mapped (host KSeg2) address, which is not handled correctly as user
+(guest) mode accesses to kernel (host) segments always generate address
+error exceptions.
+
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: kvm@vger.kernel.org
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/kvm_host.h | 1 +
+ arch/mips/kvm/interrupt.h | 1 +
+ arch/mips/kvm/locore.S | 1 +
+ arch/mips/kvm/mips.c | 11 ++++++++++-
+ 4 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/include/asm/kvm_host.h
++++ b/arch/mips/include/asm/kvm_host.h
+@@ -336,6 +336,7 @@ struct kvm_mips_tlb {
+ #define KVM_MIPS_GUEST_TLB_SIZE 64
+ struct kvm_vcpu_arch {
+ void *host_ebase, *guest_ebase;
++ int (*vcpu_run)(struct kvm_run *run, struct kvm_vcpu *vcpu);
+ unsigned long host_stack;
+ unsigned long host_gp;
+
+--- a/arch/mips/kvm/interrupt.h
++++ b/arch/mips/kvm/interrupt.h
+@@ -28,6 +28,7 @@
+ #define MIPS_EXC_MAX 12
+ /* XXXSL More to follow */
+
++extern char __kvm_mips_vcpu_run_end[];
+ extern char mips32_exception[], mips32_exceptionEnd[];
+ extern char mips32_GuestException[], mips32_GuestExceptionEnd[];
+
+--- a/arch/mips/kvm/locore.S
++++ b/arch/mips/kvm/locore.S
+@@ -227,6 +227,7 @@ FEXPORT(__kvm_mips_load_k0k1)
+
+ /* Jump to guest */
+ eret
++EXPORT(__kvm_mips_vcpu_run_end)
+
+ VECTOR(MIPSX(exception), unknown)
+ /* Find out what mode we came from and jump to the proper handler. */
+--- a/arch/mips/kvm/mips.c
++++ b/arch/mips/kvm/mips.c
+@@ -314,6 +314,15 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st
+ memcpy(gebase + offset, mips32_GuestException,
+ mips32_GuestExceptionEnd - mips32_GuestException);
+
++#ifdef MODULE
++ offset += mips32_GuestExceptionEnd - mips32_GuestException;
++ memcpy(gebase + offset, (char *)__kvm_mips_vcpu_run,
++ __kvm_mips_vcpu_run_end - (char *)__kvm_mips_vcpu_run);
++ vcpu->arch.vcpu_run = gebase + offset;
++#else
++ vcpu->arch.vcpu_run = __kvm_mips_vcpu_run;
++#endif
++
+ /* Invalidate the icache for these ranges */
+ local_flush_icache_range((unsigned long)gebase,
+ (unsigned long)gebase + ALIGN(size, PAGE_SIZE));
+@@ -403,7 +412,7 @@ int kvm_arch_vcpu_ioctl_run(struct kvm_v
+ /* Disable hardware page table walking while in guest */
+ htw_stop();
+
+- r = __kvm_mips_vcpu_run(run, vcpu);
++ r = vcpu->arch.vcpu_run(run, vcpu);
+
+ /* Re-enable HTW before enabling interrupts */
+ htw_start();
--- /dev/null
+From a8a47540ebe32f1733eebc3e5699af580ceaa3f5 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Thu, 2 Jun 2016 11:23:15 +0100
+Subject: regulator: qcom_smd: add list_voltage callback
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit a8a47540ebe32f1733eebc3e5699af580ceaa3f5 upstream.
+
+This patch adds support to list_voltage callback, so that consumers
+like mmc core, can get information of supported voltage range.
+
+Without this patch there is no way for mmc core to know this voltage range.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/qcom_smd-regulator.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -140,6 +140,7 @@ static const struct regulator_ops rpm_sm
+ .enable = rpm_reg_enable,
+ .disable = rpm_reg_disable,
+ .is_enabled = rpm_reg_is_enabled,
++ .list_voltage = regulator_list_voltage_linear_range,
+
+ .get_voltage = rpm_reg_get_voltage,
+ .set_voltage = rpm_reg_set_voltage,
--- /dev/null
+From d1e44b6b2823f1751ffe7e7589f545f05cfe2095 Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Fri, 3 Jun 2016 12:23:09 +0100
+Subject: regulator: qcom_smd: add regulator ops for pm8941 lnldo
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit d1e44b6b2823f1751ffe7e7589f545f05cfe2095 upstream.
+
+After "regulator: qcom_smd: add list_voltage callback" patch adding
+pm8941 lnldo regulators would bug on list_voltages as it is a fixed
+regulator without any linear range.
+This patch fixes that issue by adding dedicated ops for pm8941 lnldo
+without list_voltages callback.
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/qcom_smd-regulator.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -148,6 +148,17 @@ static const struct regulator_ops rpm_sm
+ .set_load = rpm_reg_set_load,
+ };
+
++static const struct regulator_ops rpm_smps_ldo_ops_fixed = {
++ .enable = rpm_reg_enable,
++ .disable = rpm_reg_disable,
++ .is_enabled = rpm_reg_is_enabled,
++
++ .get_voltage = rpm_reg_get_voltage,
++ .set_voltage = rpm_reg_set_voltage,
++
++ .set_load = rpm_reg_set_load,
++};
++
+ static const struct regulator_ops rpm_switch_ops = {
+ .enable = rpm_reg_enable,
+ .disable = rpm_reg_disable,
+@@ -248,7 +259,7 @@ static const struct regulator_desc pm894
+ static const struct regulator_desc pm8941_lnldo = {
+ .fixed_uV = 1740000,
+ .n_voltages = 1,
+- .ops = &rpm_smps_ldo_ops,
++ .ops = &rpm_smps_ldo_ops_fixed,
+ };
+
+ static const struct regulator_desc pm8941_switch = {
--- /dev/null
+From 39a9beab5acb83176e8b9a4f0778749a09341f1f Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Tue, 17 May 2016 12:38:21 -0400
+Subject: rpc: share one xps between all backchannels
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+commit 39a9beab5acb83176e8b9a4f0778749a09341f1f upstream.
+
+The spec allows backchannels for multiple clients to share the same tcp
+connection. When that happens, we need to use the same xprt for all of
+them. Similarly, we need the same xps.
+
+This fixes list corruption introduced by the multipath code.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Acked-by: Trond Myklebust <trondmy@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/sunrpc/svc_xprt.h | 1 +
+ include/linux/sunrpc/xprt.h | 1 +
+ net/sunrpc/clnt.c | 18 ++++++++++++++----
+ net/sunrpc/svc_xprt.c | 2 ++
+ net/sunrpc/xprtsock.c | 1 +
+ 5 files changed, 19 insertions(+), 4 deletions(-)
+
+--- a/include/linux/sunrpc/svc_xprt.h
++++ b/include/linux/sunrpc/svc_xprt.h
+@@ -84,6 +84,7 @@ struct svc_xprt {
+
+ struct net *xpt_net;
+ struct rpc_xprt *xpt_bc_xprt; /* NFSv4.1 backchannel */
++ struct rpc_xprt_switch *xpt_bc_xps; /* NFSv4.1 backchannel */
+ };
+
+ static inline void unregister_xpt_user(struct svc_xprt *xpt, struct svc_xpt_user *u)
+--- a/include/linux/sunrpc/xprt.h
++++ b/include/linux/sunrpc/xprt.h
+@@ -296,6 +296,7 @@ struct xprt_create {
+ size_t addrlen;
+ const char *servername;
+ struct svc_xprt *bc_xprt; /* NFSv4.1 backchannel */
++ struct rpc_xprt_switch *bc_xps;
+ unsigned int flags;
+ };
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -452,10 +452,20 @@ static struct rpc_clnt *rpc_create_xprt(
+ struct rpc_clnt *clnt = NULL;
+ struct rpc_xprt_switch *xps;
+
+- xps = xprt_switch_alloc(xprt, GFP_KERNEL);
+- if (xps == NULL) {
+- xprt_put(xprt);
+- return ERR_PTR(-ENOMEM);
++ if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
++ WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
++ xps = args->bc_xprt->xpt_bc_xps;
++ xprt_switch_get(xps);
++ } else {
++ xps = xprt_switch_alloc(xprt, GFP_KERNEL);
++ if (xps == NULL) {
++ xprt_put(xprt);
++ return ERR_PTR(-ENOMEM);
++ }
++ if (xprt->bc_xprt) {
++ xprt_switch_get(xps);
++ xprt->bc_xprt->xpt_bc_xps = xps;
++ }
+ }
+ clnt = rpc_new_client(args, xps, xprt, NULL);
+ if (IS_ERR(clnt))
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -136,6 +136,8 @@ static void svc_xprt_free(struct kref *k
+ /* See comment on corresponding get in xs_setup_bc_tcp(): */
+ if (xprt->xpt_bc_xprt)
+ xprt_put(xprt->xpt_bc_xprt);
++ if (xprt->xpt_bc_xps)
++ xprt_switch_put(xprt->xpt_bc_xps);
+ xprt->xpt_ops->xpo_free(xprt);
+ module_put(owner);
+ }
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -3050,6 +3050,7 @@ static struct rpc_xprt *xs_setup_bc_tcp(
+ return xprt;
+
+ args->bc_xprt->xpt_bc_xprt = NULL;
++ args->bc_xprt->xpt_bc_xps = NULL;
+ xprt_put(xprt);
+ ret = ERR_PTR(-EINVAL);
+ out_err:
nfs-fix-a-double-page-unlock.patch
make-nfs_atomic_open-call-d_drop-on-all-open_context-errors.patch
nfs-fix-another-open_downgrade-bug.patch
+sunrpc-fix-xprt-leak-on-xps-allocation-failure.patch
+rpc-share-one-xps-between-all-backchannels.patch
+regulator-qcom_smd-add-list_voltage-callback.patch
+regulator-qcom_smd-add-regulator-ops-for-pm8941-lnldo.patch
+arm-imx6ul-fix-micrel-phy-mask.patch
+arm-8578-1-mm-ensure-pmd_present-only-checks-the-valid-bit.patch
+arm-8579-1-mm-fix-definition-of-pmd_mknotpresent.patch
+arm-dts-sun6i-yones-toptech-bs1078-v2-drop-constraints-on-dc1sw-regulator.patch
+arm-dts-sun6i-primo81-drop-constraints-on-dc1sw-regulator.patch
+mips-kvm-fix-modular-kvm-under-qemu.patch
+irqchip-mips-gic-fix-irqs-in-gic_dev_domain.patch
+ubifs-implement-migratepage.patch
--- /dev/null
+From 1208fd569c07ab84aa5d024abd863267c2953b4a Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Fri, 20 May 2016 17:07:17 -0400
+Subject: SUNRPC: fix xprt leak on xps allocation failure
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+commit 1208fd569c07ab84aa5d024abd863267c2953b4a upstream.
+
+Callers of rpc_create_xprt expect it to put the xprt on success and
+failure.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Acked-by: Trond Myklebust <trondmy@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/clnt.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -453,9 +453,10 @@ static struct rpc_clnt *rpc_create_xprt(
+ struct rpc_xprt_switch *xps;
+
+ xps = xprt_switch_alloc(xprt, GFP_KERNEL);
+- if (xps == NULL)
++ if (xps == NULL) {
++ xprt_put(xprt);
+ return ERR_PTR(-ENOMEM);
+-
++ }
+ clnt = rpc_new_client(args, xps, xprt, NULL);
+ if (IS_ERR(clnt))
+ return clnt;
--- /dev/null
+From 4ac1c17b2044a1b4b2fbed74451947e905fc2992 Mon Sep 17 00:00:00 2001
+From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Date: Thu, 16 Jun 2016 23:26:15 +0200
+Subject: UBIFS: Implement ->migratepage()
+
+From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+
+commit 4ac1c17b2044a1b4b2fbed74451947e905fc2992 upstream.
+
+During page migrations UBIFS might get confused
+and the following assert triggers:
+[ 213.480000] UBIFS assert failed in ubifs_set_page_dirty at 1451 (pid 436)
+[ 213.490000] CPU: 0 PID: 436 Comm: drm-stress-test Not tainted 4.4.4-00176-geaa802524636-dirty #1008
+[ 213.490000] Hardware name: Allwinner sun4i/sun5i Families
+[ 213.490000] [<c0015e70>] (unwind_backtrace) from [<c0012cdc>] (show_stack+0x10/0x14)
+[ 213.490000] [<c0012cdc>] (show_stack) from [<c02ad834>] (dump_stack+0x8c/0xa0)
+[ 213.490000] [<c02ad834>] (dump_stack) from [<c0236ee8>] (ubifs_set_page_dirty+0x44/0x50)
+[ 213.490000] [<c0236ee8>] (ubifs_set_page_dirty) from [<c00fa0bc>] (try_to_unmap_one+0x10c/0x3a8)
+[ 213.490000] [<c00fa0bc>] (try_to_unmap_one) from [<c00fadb4>] (rmap_walk+0xb4/0x290)
+[ 213.490000] [<c00fadb4>] (rmap_walk) from [<c00fb1bc>] (try_to_unmap+0x64/0x80)
+[ 213.490000] [<c00fb1bc>] (try_to_unmap) from [<c010dc28>] (migrate_pages+0x328/0x7a0)
+[ 213.490000] [<c010dc28>] (migrate_pages) from [<c00d0cb0>] (alloc_contig_range+0x168/0x2f4)
+[ 213.490000] [<c00d0cb0>] (alloc_contig_range) from [<c010ec00>] (cma_alloc+0x170/0x2c0)
+[ 213.490000] [<c010ec00>] (cma_alloc) from [<c001a958>] (__alloc_from_contiguous+0x38/0xd8)
+[ 213.490000] [<c001a958>] (__alloc_from_contiguous) from [<c001ad44>] (__dma_alloc+0x23c/0x274)
+[ 213.490000] [<c001ad44>] (__dma_alloc) from [<c001ae08>] (arm_dma_alloc+0x54/0x5c)
+[ 213.490000] [<c001ae08>] (arm_dma_alloc) from [<c035cecc>] (drm_gem_cma_create+0xb8/0xf0)
+[ 213.490000] [<c035cecc>] (drm_gem_cma_create) from [<c035cf20>] (drm_gem_cma_create_with_handle+0x1c/0xe8)
+[ 213.490000] [<c035cf20>] (drm_gem_cma_create_with_handle) from [<c035d088>] (drm_gem_cma_dumb_create+0x3c/0x48)
+[ 213.490000] [<c035d088>] (drm_gem_cma_dumb_create) from [<c0341ed8>] (drm_ioctl+0x12c/0x444)
+[ 213.490000] [<c0341ed8>] (drm_ioctl) from [<c0121adc>] (do_vfs_ioctl+0x3f4/0x614)
+[ 213.490000] [<c0121adc>] (do_vfs_ioctl) from [<c0121d30>] (SyS_ioctl+0x34/0x5c)
+[ 213.490000] [<c0121d30>] (SyS_ioctl) from [<c000f2c0>] (ret_fast_syscall+0x0/0x34)
+
+UBIFS is using PagePrivate() which can have different meanings across
+filesystems. Therefore the generic page migration code cannot handle this
+case correctly.
+We have to implement our own migration function which basically does a
+plain copy but also duplicates the page private flag.
+UBIFS is not a block device filesystem and cannot use buffer_migrate_page().
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+[rw: Massaged changelog, build fixes, etc...]
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Acked-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/file.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/fs/ubifs/file.c
++++ b/fs/ubifs/file.c
+@@ -52,6 +52,7 @@
+ #include "ubifs.h"
+ #include <linux/mount.h>
+ #include <linux/slab.h>
++#include <linux/migrate.h>
+
+ static int read_block(struct inode *inode, void *addr, unsigned int block,
+ struct ubifs_data_node *dn)
+@@ -1452,6 +1453,26 @@ static int ubifs_set_page_dirty(struct p
+ return ret;
+ }
+
++#ifdef CONFIG_MIGRATION
++static int ubifs_migrate_page(struct address_space *mapping,
++ struct page *newpage, struct page *page, enum migrate_mode mode)
++{
++ int rc;
++
++ rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode, 0);
++ if (rc != MIGRATEPAGE_SUCCESS)
++ return rc;
++
++ if (PagePrivate(page)) {
++ ClearPagePrivate(page);
++ SetPagePrivate(newpage);
++ }
++
++ migrate_page_copy(newpage, page);
++ return MIGRATEPAGE_SUCCESS;
++}
++#endif
++
+ static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags)
+ {
+ /*
+@@ -1591,6 +1612,9 @@ const struct address_space_operations ub
+ .write_end = ubifs_write_end,
+ .invalidatepage = ubifs_invalidatepage,
+ .set_page_dirty = ubifs_set_page_dirty,
++#ifdef CONFIG_MIGRATION
++ .migratepage = ubifs_migrate_page,
++#endif
+ .releasepage = ubifs_releasepage,
+ };
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
