--- /dev/null
+From 87f5fedb3bebbbb566f847dd0c567fcea49a36a6 Mon Sep 17 00:00:00 2001
+From: Lukasz Duda <lukasz.duda@nordicsemi.no>
+Date: Wed, 13 Jan 2016 16:57:48 +0100
+Subject: Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packets
+
+From: Lukasz Duda <lukasz.duda@nordicsemi.no>
+
+commit 87f5fedb3bebbbb566f847dd0c567fcea49a36a6 upstream.
+
+This patch fixes incorrect handling of the 6lowpan packets that contain
+uncompressed IPv6 header.
+
+RFC4944 specifies a special dispatch for 6lowpan to carry uncompressed
+IPv6 header. This dispatch (1 byte long) has to be removed during
+reception and skb data pointer has to be moved. To correctly point in
+the beginning of the IPv6 header the dispatch byte has to be pulled off
+before packet can be processed by netif_rx_in().
+
+Test scenario: IPv6 packets are not correctly interpreted by the network
+layer when IPv6 header is not compressed (e.g. ICMPv6 Echo Reply is not
+propagated correctly to the ICMPv6 layer because the extra byte will make
+the header look corrupted).
+
+Similar approach is done for IEEE 802.15.4.
+
+Signed-off-by: Lukasz Duda <lukasz.duda@nordicsemi.no>
+Signed-off-by: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
+Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/6lowpan.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -307,6 +307,9 @@ static int recv_pkt(struct sk_buff *skb,
+
+ /* check that it's our buffer */
+ if (lowpan_is_ipv6(*skb_network_header(skb))) {
++ /* Pull off the 1-byte of 6lowpan header. */
++ skb_pull(skb, 1);
++
+ /* Copy the packet so that the IPv6 header is
+ * properly aligned.
+ */
--- /dev/null
+From 4c58f3282e3de43d34f8955f8eca676294380bf9 Mon Sep 17 00:00:00 2001
+From: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
+Date: Wed, 13 Jan 2016 16:41:42 +0100
+Subject: Bluetooth: 6lowpan: Fix kernel NULL pointer dereferences
+
+From: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
+
+commit 4c58f3282e3de43d34f8955f8eca676294380bf9 upstream.
+
+The fixes provided in this patch assigns a valid net_device structure to
+skb before dispatching it for further processing.
+
+Scenario #1:
+============
+
+Bluetooth 6lowpan receives an uncompressed IPv6 header, and dispatches it
+to netif. The following error occurs:
+
+Null pointer dereference error #1 crash log:
+
+[ 845.854013] BUG: unable to handle kernel NULL pointer dereference at
+ 0000000000000048
+[ 845.855785] IP: [<ffffffff816e3d36>] enqueue_to_backlog+0x56/0x240
+...
+[ 845.909459] Call Trace:
+[ 845.911678] [<ffffffff816e3f64>] netif_rx_internal+0x44/0xf0
+
+The first modification fixes the NULL pointer dereference error by
+assigning dev to the local_skb in order to set a valid net_device before
+processing the skb by netif_rx_ni().
+
+Scenario #2:
+============
+
+Bluetooth 6lowpan receives an UDP compressed message which needs further
+decompression by nhc_udp. The following error occurs:
+
+Null pointer dereference error #2 crash log:
+
+[ 63.295149] BUG: unable to handle kernel NULL pointer dereference at
+ 0000000000000840
+[ 63.295931] IP: [<ffffffffc0559540>] udp_uncompress+0x320/0x626
+ [nhc_udp]
+
+The second modification fixes the NULL pointer dereference error by
+assigning dev to the local_skb in the case of a udp compressed packet.
+The 6lowpan udp_uncompress function expects that the net_device is set in
+the skb when checking lltype.
+
+Signed-off-by: Glenn Ruben Bakke <glenn.ruben.bakke@nordicsemi.no>
+Signed-off-by: Lukasz Duda <lukasz.duda@nordicsemi.no>
+Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/6lowpan.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -317,6 +317,7 @@ static int recv_pkt(struct sk_buff *skb,
+
+ local_skb->protocol = htons(ETH_P_IPV6);
+ local_skb->pkt_type = PACKET_HOST;
++ local_skb->dev = dev;
+
+ skb_set_transport_header(local_skb, sizeof(struct ipv6hdr));
+
+@@ -335,6 +336,8 @@ static int recv_pkt(struct sk_buff *skb,
+ if (!local_skb)
+ goto drop;
+
++ local_skb->dev = dev;
++
+ ret = iphc_decompress(local_skb, dev, chan);
+ if (ret < 0) {
+ kfree_skb(local_skb);
+@@ -343,7 +346,6 @@ static int recv_pkt(struct sk_buff *skb,
+
+ local_skb->protocol = htons(ETH_P_IPV6);
+ local_skb->pkt_type = PACKET_HOST;
+- local_skb->dev = dev;
+
+ if (give_skb_to_upper(local_skb, dev)
+ != NET_RX_SUCCESS) {
--- /dev/null
+From 1623d0bf847d3b38d8cf24367b3689ba0e3fe2aa Mon Sep 17 00:00:00 2001
+From: Dmitry Tunin <hanipouspilot@gmail.com>
+Date: Sat, 5 Dec 2015 14:09:36 +0300
+Subject: Bluetooth: Add support of Toshiba Broadcom based devices
+
+From: Dmitry Tunin <hanipouspilot@gmail.com>
+
+commit 1623d0bf847d3b38d8cf24367b3689ba0e3fe2aa upstream.
+
+BugLink: https://bugs.launchpad.net/bugs/1522949
+
+ T: Bus=03 Lev=02 Prnt=02 Port=05 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
+ D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+ P: Vendor=0930 ProdID=0225 Rev=01.12
+ S: Manufacturer=Broadcom Corp
+ S: Product=BCM43142A0
+ S: SerialNumber=4CBB58034671
+ C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=0mA
+ I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+ I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=(none)
+ I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
+ I: If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none)
+
+Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -153,6 +153,10 @@ static const struct usb_device_id btusb_
+ { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
+ .driver_info = BTUSB_BCM_PATCHRAM },
+
++ /* Toshiba Corp - Broadcom based */
++ { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
++ .driver_info = BTUSB_BCM_PATCHRAM },
++
+ /* Intel Bluetooth USB Bootloader (RAM module) */
+ { USB_DEVICE(0x8087, 0x0a5a),
+ .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
--- /dev/null
+From cff10ce7b4f02718ffd25e3914e60559f5ef6ca0 Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Tue, 26 Jan 2016 14:31:31 -0500
+Subject: Bluetooth: Fix incorrect removing of IRKs
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit cff10ce7b4f02718ffd25e3914e60559f5ef6ca0 upstream.
+
+The commit cad20c278085d893ebd616cd20c0747a8e9d53c7 was supposed to
+fix handling of devices first using public addresses and then
+switching to RPAs after pairing. Unfortunately it missed a couple of
+key places in the code.
+
+1. When evaluating which devices should be removed from the existing
+white list we also need to consider whether we have an IRK for them or
+not, i.e. a call to hci_find_irk_by_addr() is needed.
+
+2. In smp_notify_keys() we should not be requiring the knowledge of
+the RPA, but should simply keep the IRK around if the other conditions
+require it.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_request.c | 28 ++++++++++++++++++----------
+ net/bluetooth/smp.c | 16 ----------------
+ 2 files changed, 18 insertions(+), 26 deletions(-)
+
+--- a/net/bluetooth/hci_request.c
++++ b/net/bluetooth/hci_request.c
+@@ -175,21 +175,29 @@ static u8 update_white_list(struct hci_r
+ * command to remove it from the controller.
+ */
+ list_for_each_entry(b, &hdev->le_white_list, list) {
+- struct hci_cp_le_del_from_white_list cp;
++ /* If the device is neither in pend_le_conns nor
++ * pend_le_reports then remove it from the whitelist.
++ */
++ if (!hci_pend_le_action_lookup(&hdev->pend_le_conns,
++ &b->bdaddr, b->bdaddr_type) &&
++ !hci_pend_le_action_lookup(&hdev->pend_le_reports,
++ &b->bdaddr, b->bdaddr_type)) {
++ struct hci_cp_le_del_from_white_list cp;
+
+- if (hci_pend_le_action_lookup(&hdev->pend_le_conns,
+- &b->bdaddr, b->bdaddr_type) ||
+- hci_pend_le_action_lookup(&hdev->pend_le_reports,
+- &b->bdaddr, b->bdaddr_type)) {
+- white_list_entries++;
++ cp.bdaddr_type = b->bdaddr_type;
++ bacpy(&cp.bdaddr, &b->bdaddr);
++
++ hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
++ sizeof(cp), &cp);
+ continue;
+ }
+
+- cp.bdaddr_type = b->bdaddr_type;
+- bacpy(&cp.bdaddr, &b->bdaddr);
++ if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
++ /* White list can not be used with RPAs */
++ return 0x00;
++ }
+
+- hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
+- sizeof(cp), &cp);
++ white_list_entries++;
+ }
+
+ /* Since all no longer valid white list entries have been
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -1072,22 +1072,6 @@ static void smp_notify_keys(struct l2cap
+ hcon->dst_type = smp->remote_irk->addr_type;
+ queue_work(hdev->workqueue, &conn->id_addr_update_work);
+ }
+-
+- /* When receiving an indentity resolving key for
+- * a remote device that does not use a resolvable
+- * private address, just remove the key so that
+- * it is possible to use the controller white
+- * list for scanning.
+- *
+- * Userspace will have been told to not store
+- * this key at this point. So it is safe to
+- * just remove it.
+- */
+- if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
+- list_del_rcu(&smp->remote_irk->list);
+- kfree_rcu(smp->remote_irk, rcu);
+- smp->remote_irk = NULL;
+- }
+ }
+
+ if (smp->csrk) {
--- /dev/null
+From 2f99536a5b34d5b0f54723067d68f6cef3f0fdc6 Mon Sep 17 00:00:00 2001
+From: Johan Hedberg <johan.hedberg@intel.com>
+Date: Thu, 3 Dec 2015 12:45:19 +0200
+Subject: Bluetooth: Use continuous scanning when creating LE connections
+
+From: Johan Hedberg <johan.hedberg@intel.com>
+
+commit 2f99536a5b34d5b0f54723067d68f6cef3f0fdc6 upstream.
+
+All LE connections are now triggered through a preceding passive scan
+and waiting for a connectable advertising report. This means we've got
+the best possible guarantee that the device is within range and should
+be able to request the controller to perform continuous scanning. This
+way we minimize the risk that we miss out on any advertising packets.
+
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_conn.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -722,8 +722,12 @@ static void hci_req_add_le_create_conn(s
+ if (hci_update_random_address(req, false, &own_addr_type))
+ return;
+
++ /* Set window to be the same value as the interval to enable
++ * continuous scanning.
++ */
+ cp.scan_interval = cpu_to_le16(hdev->le_scan_interval);
+- cp.scan_window = cpu_to_le16(hdev->le_scan_window);
++ cp.scan_window = cp.scan_interval;
++
+ bacpy(&cp.peer_addr, &conn->dst);
+ cp.peer_addr_type = conn->dst_type;
+ cp.own_address_type = own_addr_type;
--- /dev/null
+From 6b4feaea251a97bf08c7d41eabdec07f63a11073 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Fri, 11 Dec 2015 15:38:40 +0100
+Subject: clk: exynos: use irqsave version of spin_lock to avoid deadlock with irqs
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 6b4feaea251a97bf08c7d41eabdec07f63a11073 upstream.
+
+It is allowed to enable/disable clocks from interrupts, so common Exynos
+ARM clock management code for CPUfreq should use 'irqsave' version of
+spin_lock calls to avoid potential deadlock caused by spin_lock recursion.
+The same spin_lock is used by gate/mux clocks during enable/disable calls.
+
+This deadlock, can be reproduced by enabling CPUfreq (ondemand or
+userspace) and decoding video with s5p-mfc driver.
+
+Relevant stack trace:
+[ 5928.061534] BUG: spinlock recursion on CPU#0, bash/1252
+[ 5928.061609] lock: 0xee80454c, .magic: dead4ead, .owner: bash/1252, .owner_cpu: 0
+[ 5928.068586] CPU: 0 PID: 1252 Comm: bash Tainted: G W 4.4.0-rc4-00001-g447a7fd #678
+[ 5928.077260] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
+[ 5928.083359] [<c00153dc>] (unwind_backtrace) from [<c00121b4>] (show_stack+0x10/0x14)
+[ 5928.091072] [<c00121b4>] (show_stack) from [<c0213e28>] (dump_stack+0x68/0xb8)
+[ 5928.098275] [<c0213e28>] (dump_stack) from [<c005c1ec>] (do_raw_spin_lock+0x184/0x1ac)
+[ 5928.106177] [<c005c1ec>] (do_raw_spin_lock) from [<c05cfa98>] (_raw_spin_lock_irqsave+0x20/0x28)
+[ 5928.114943] [<c05cfa98>] (_raw_spin_lock_irqsave) from [<c0468698>] (clk_gate_endisable+0x24/0x98)
+[ 5928.123882] [<c0468698>] (clk_gate_endisable) from [<c0464d40>] (clk_core_disable+0x60/0x84)
+[ 5928.132299] [<c0464d40>] (clk_core_disable) from [<c0465e00>] (clk_disable+0x24/0x30)
+[ 5928.140117] [<c0465e00>] (clk_disable) from [<c03f3b80>] (s5p_mfc_handle_frame+0x254/0x860)
+[ 5928.148445] [<c03f3b80>] (s5p_mfc_handle_frame) from [<c03f4b34>] (s5p_mfc_irq+0x890/0xa24)
+[ 5928.156778] [<c03f4b34>] (s5p_mfc_irq) from [<c00627bc>] (handle_irq_event_percpu+0x50/0x14c)
+[ 5928.165283] [<c00627bc>] (handle_irq_event_percpu) from [<c00628f0>] (handle_irq_event+0x38/0x5c)
+[ 5928.174143] [<c00628f0>] (handle_irq_event) from [<c0065864>] (handle_fasteoi_irq+0xdc/0x1a4)
+[ 5928.182645] [<c0065864>] (handle_fasteoi_irq) from [<c0062090>] (generic_handle_irq+0x18/0x28)
+[ 5928.191236] [<c0062090>] (generic_handle_irq) from [<c00621a4>] (__handle_domain_irq+0x6c/0xdc)
+[ 5928.199917] [<c00621a4>] (__handle_domain_irq) from [<c0009470>] (gic_handle_irq+0x4c/0x98)
+[ 5928.208249] [<c0009470>] (gic_handle_irq) from [<c0012c54>] (__irq_svc+0x54/0x90)
+[ 5928.215709] Exception stack(0xeddb5cb8 to 0xeddb5d00)
+[ 5928.220745] 5ca0: ee80454c faddfadc
+[ 5928.228906] 5cc0: 00000000 01000001 ee831ce0 f8114200 ee807c00 01130520 00000403 eddb5d84
+[ 5928.237063] 5ce0: ee807c48 2faf0800 ee807c0c eddb5d08 c046b618 c046b634 20000053 ffffffff
+[ 5928.245225] [<c0012c54>] (__irq_svc) from [<c046b634>] (exynos_cpuclk_notifier_cb+0x170/0x270)
+[ 5928.253823] [<c046b634>] (exynos_cpuclk_notifier_cb) from [<c003cb58>] (notifier_call_chain+0x44/0x84)
+[ 5928.263106] [<c003cb58>] (notifier_call_chain) from [<c003ccd4>] (__srcu_notifier_call_chain+0x6c/0x9c)
+[ 5928.272480] [<c003ccd4>] (__srcu_notifier_call_chain) from [<c003cd1c>] (srcu_notifier_call_chain+0x18/0x20)
+[ 5928.282288] [<c003cd1c>] (srcu_notifier_call_chain) from [<c0464ed0>] (__clk_notify+0x6c/0x74)
+[ 5928.290881] [<c0464ed0>] (__clk_notify) from [<c0465388>] (clk_propagate_rate_change+0xa0/0xac)
+[ 5928.299561] [<c0465388>] (clk_propagate_rate_change) from [<c0465378>] (clk_propagate_rate_change+0x90/0xac)
+[ 5928.309370] [<c0465378>] (clk_propagate_rate_change) from [<c04666fc>] (clk_core_set_rate_nolock+0x64/0xa8)
+[ 5928.319091] [<c04666fc>] (clk_core_set_rate_nolock) from [<c0466760>] (clk_set_rate+0x20/0x30)
+[ 5928.327686] [<c0466760>] (clk_set_rate) from [<c0428c70>] (set_target+0xe8/0x23c)
+[ 5928.335152] [<c0428c70>] (set_target) from [<c04244d0>] (__cpufreq_driver_target+0x184/0x29c)
+[ 5928.343655] [<c04244d0>] (__cpufreq_driver_target) from [<c0427128>] (cpufreq_set+0x44/0x64)
+[ 5928.352074] [<c0427128>] (cpufreq_set) from [<c0423948>] (store_scaling_setspeed+0x5c/0x74)
+[ 5928.360407] [<c0423948>] (store_scaling_setspeed) from [<c04238d0>] (store+0x7c/0x98)
+[ 5928.368221] [<c04238d0>] (store) from [<c0132540>] (sysfs_kf_write+0x44/0x48)
+[ 5928.375338] [<c0132540>] (sysfs_kf_write) from [<c0131b9c>] (kernfs_fop_write+0xb8/0x1bc)
+[ 5928.383496] [<c0131b9c>] (kernfs_fop_write) from [<c00d71f8>] (__vfs_write+0x2c/0xd4)
+[ 5928.391308] [<c00d71f8>] (__vfs_write) from [<c00d7de8>] (vfs_write+0xa0/0x144)
+[ 5928.398598] [<c00d7de8>] (vfs_write) from [<c00d8048>] (SyS_write+0x44/0x84)
+[ 5928.405631] [<c00d8048>] (SyS_write) from [<c000f540>] (ret_fast_syscall+0x0/0x3c)
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/samsung/clk-cpu.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/samsung/clk-cpu.c
++++ b/drivers/clk/samsung/clk-cpu.c
+@@ -148,6 +148,7 @@ static int exynos_cpuclk_pre_rate_change
+ unsigned long alt_prate = clk_get_rate(cpuclk->alt_parent);
+ unsigned long alt_div = 0, alt_div_mask = DIV_MASK;
+ unsigned long div0, div1 = 0, mux_reg;
++ unsigned long flags;
+
+ /* find out the divider values to use for clock data */
+ while ((cfg_data->prate * 1000) != ndata->new_rate) {
+@@ -156,7 +157,7 @@ static int exynos_cpuclk_pre_rate_change
+ cfg_data++;
+ }
+
+- spin_lock(cpuclk->lock);
++ spin_lock_irqsave(cpuclk->lock, flags);
+
+ /*
+ * For the selected PLL clock frequency, get the pre-defined divider
+@@ -212,7 +213,7 @@ static int exynos_cpuclk_pre_rate_change
+ DIV_MASK_ALL);
+ }
+
+- spin_unlock(cpuclk->lock);
++ spin_unlock_irqrestore(cpuclk->lock, flags);
+ return 0;
+ }
+
+@@ -223,6 +224,7 @@ static int exynos_cpuclk_post_rate_chang
+ const struct exynos_cpuclk_cfg_data *cfg_data = cpuclk->cfg;
+ unsigned long div = 0, div_mask = DIV_MASK;
+ unsigned long mux_reg;
++ unsigned long flags;
+
+ /* find out the divider values to use for clock data */
+ if (cpuclk->flags & CLK_CPU_NEEDS_DEBUG_ALT_DIV) {
+@@ -233,7 +235,7 @@ static int exynos_cpuclk_post_rate_chang
+ }
+ }
+
+- spin_lock(cpuclk->lock);
++ spin_lock_irqsave(cpuclk->lock, flags);
+
+ /* select mout_apll as the alternate parent */
+ mux_reg = readl(base + E4210_SRC_CPU);
+@@ -246,7 +248,7 @@ static int exynos_cpuclk_post_rate_chang
+ }
+
+ exynos_set_safe_div(base, div, div_mask);
+- spin_unlock(cpuclk->lock);
++ spin_unlock_irqrestore(cpuclk->lock, flags);
+ return 0;
+ }
+
--- /dev/null
+From f02b4b72d12cbae7020a959e2ed0410a464b4cc4 Mon Sep 17 00:00:00 2001
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Date: Fri, 15 Jan 2016 11:34:21 +0100
+Subject: clockevents/tcb_clksrc: Prevent disabling an already disabled clock
+
+From: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+
+commit f02b4b72d12cbae7020a959e2ed0410a464b4cc4 upstream.
+
+clockevents_exchange_device is calling clockevents_shutdown() on the new
+clockenvents device but it may have never been enabled in the first place.
+This results in the tcb clock being disabled without being enabled first:
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 1 at drivers/clk/clk.c:680 clk_disable+0x28/0x34()
+Modules linked in:
+CPU: 0 PID: 1 Comm: swapper Not tainted 4.4.0+ #6
+Hardware name: Atmel AT91SAM9
+[<c000f2b8>] (unwind_backtrace) from [<c000d01c>] (show_stack+0x10/0x14)
+[<c000d01c>] (show_stack) from [<c00172f0>] (warn_slowpath_common+0x78/0xa0)
+[<c00172f0>] (warn_slowpath_common) from [<c00173a8>] (warn_slowpath_null+0x18/0x20)
+[<c00173a8>] (warn_slowpath_null) from [<c0361528>] (clk_disable+0x28/0x34)
+[<c0361528>] (clk_disable) from [<c034d560>] (tc_shutdown+0x38/0x4c)
+[<c034d560>] (tc_shutdown) from [<c0059ad4>] (clockevents_switch_state+0x38/0x6c)
+[<c0059ad4>] (clockevents_switch_state) from [<c0059b18>] (clockevents_shutdown+0x10/0x24)
+[<c0059b18>] (clockevents_shutdown) from [<c005a458>] (tick_check_new_device+0x84/0xac)
+[<c005a458>] (tick_check_new_device) from [<c0059660>] (clockevents_register_device+0x7c/0x108)
+[<c0059660>] (clockevents_register_device) from [<c06b5a68>] (tcb_clksrc_init+0x390/0x3e8)
+[<c06b5a68>] (tcb_clksrc_init) from [<c00097cc>] (do_one_initcall+0x114/0x1d4)
+[<c00097cc>] (do_one_initcall) from [<c069bd54>] (kernel_init_freeable+0xfc/0x1b8)
+[<c069bd54>] (kernel_init_freeable) from [<c04c3818>] (kernel_init+0x8/0xe0)
+[<c04c3818>] (kernel_init) from [<c000a410>] (ret_from_fork+0x14/0x24)
+---[ end trace 0000000000000001 ]---
+
+Check what state we were in before trying to disable the clock.
+
+Fixes: cf4541c101ea ("clockevents/drivers/tcb_clksrc: Migrate to new 'set-state' interface")
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
+Cc: Boris Brezillon <boris.brezillon@free-electrons.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: http://lkml.kernel.org/r/1452854061-30370-1-git-send-email-alexandre.belloni@free-electrons.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clocksource/tcb_clksrc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/clocksource/tcb_clksrc.c
++++ b/drivers/clocksource/tcb_clksrc.c
+@@ -98,7 +98,8 @@ static int tc_shutdown(struct clock_even
+
+ __raw_writel(0xff, regs + ATMEL_TC_REG(2, IDR));
+ __raw_writel(ATMEL_TC_CLKDIS, regs + ATMEL_TC_REG(2, CCR));
+- clk_disable(tcd->clk);
++ if (!clockevent_state_detached(d))
++ clk_disable(tcd->clk);
+
+ return 0;
+ }
--- /dev/null
+From 0f26922fe5dc5724b1adbbd54b21bad03590b4f3 Mon Sep 17 00:00:00 2001
+From: zengtao <prime.zeng@huawei.com>
+Date: Tue, 2 Feb 2016 11:38:34 +0800
+Subject: cputime: Prevent 32bit overflow in time[val|spec]_to_cputime()
+
+From: zengtao <prime.zeng@huawei.com>
+
+commit 0f26922fe5dc5724b1adbbd54b21bad03590b4f3 upstream.
+
+The datatype __kernel_time_t is u32 on 32bit platform, so its subject to
+overflows in the timeval/timespec to cputime conversion.
+
+Currently the following functions are affected:
+1. setitimer()
+2. timer_create/timer_settime()
+3. sys_clock_nanosleep
+
+This can happen on MIPS32 and ARM32 with "Full dynticks CPU time accounting"
+enabled, which is required for CONFIG_NO_HZ_FULL.
+
+Enforce u64 conversion to prevent the overflow.
+
+Fixes: 31c1fc818715 ("ARM: Kconfig: allow full nohz CPU accounting")
+Signed-off-by: zengtao <prime.zeng@huawei.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Cc: <fweisbec@gmail.com>
+Link: http://lkml.kernel.org/r/1454384314-154784-1-git-send-email-prime.zeng@huawei.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/asm-generic/cputime_nsecs.h | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/include/asm-generic/cputime_nsecs.h
++++ b/include/asm-generic/cputime_nsecs.h
+@@ -75,7 +75,7 @@ typedef u64 __nocast cputime64_t;
+ */
+ static inline cputime_t timespec_to_cputime(const struct timespec *val)
+ {
+- u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_nsec;
++ u64 ret = (u64)val->tv_sec * NSEC_PER_SEC + val->tv_nsec;
+ return (__force cputime_t) ret;
+ }
+ static inline void cputime_to_timespec(const cputime_t ct, struct timespec *val)
+@@ -91,7 +91,8 @@ static inline void cputime_to_timespec(c
+ */
+ static inline cputime_t timeval_to_cputime(const struct timeval *val)
+ {
+- u64 ret = val->tv_sec * NSEC_PER_SEC + val->tv_usec * NSEC_PER_USEC;
++ u64 ret = (u64)val->tv_sec * NSEC_PER_SEC +
++ val->tv_usec * NSEC_PER_USEC;
+ return (__force cputime_t) ret;
+ }
+ static inline void cputime_to_timeval(const cputime_t ct, struct timeval *val)
--- /dev/null
+From 48f0f6b717e314a30be121b67e1d044f6d311d66 Mon Sep 17 00:00:00 2001
+From: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
+Date: Wed, 4 Nov 2015 13:24:09 +1100
+Subject: cxl: use correct operator when writing pcie config space values
+
+From: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
+
+commit 48f0f6b717e314a30be121b67e1d044f6d311d66 upstream.
+
+When writing a value to config space, cxl_pcie_write_config() calls
+cxl_pcie_config_info() to obtain a mask and shift value, shifts the new
+value accordingly, then uses the mask to combine the shifted value with the
+existing value at the address as part of a read-modify-write pattern.
+
+Currently, we use a logical OR operator rather than a bitwise OR operator,
+which means any use of this function results in an incorrect value being
+written. Replace the logical OR operator with a bitwise OR operator so the
+value is written correctly.
+
+Reported-by: Michael Ellerman <mpe@ellerman.id.au>
+Fixes: 6f7f0b3df6d4 ("cxl: Add AFU virtual PHB and kernel API")
+Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
+Acked-by: Ian Munsie <imunsie@au1.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/cxl/vphb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/cxl/vphb.c
++++ b/drivers/misc/cxl/vphb.c
+@@ -203,7 +203,7 @@ static int cxl_pcie_write_config(struct
+ mask <<= shift;
+ val <<= shift;
+
+- v = (in_le32(ioaddr) & ~mask) || (val & mask);
++ v = (in_le32(ioaddr) & ~mask) | (val & mask);
+
+ out_le32(ioaddr, v);
+ return PCIBIOS_SUCCESSFUL;
--- /dev/null
+From 8599846d73997cdbccf63f23394d871cfad1e5e6 Mon Sep 17 00:00:00 2001
+From: "K. Y. Srinivasan" <kys@microsoft.com>
+Date: Mon, 14 Dec 2015 16:01:54 -0800
+Subject: Drivers: hv: vmbus: Fix a Host signaling bug
+
+From: K. Y. Srinivasan <kys@microsoft.com>
+
+commit 8599846d73997cdbccf63f23394d871cfad1e5e6 upstream.
+
+Currently we have two policies for deciding when to signal the host:
+One based on the ring buffer state and the other based on what the
+VMBUS client driver wants to do. Consider the case when the client
+wants to explicitly control when to signal the host. In this case,
+if the client were to defer signaling, we will not be able to signal
+the host subsequently when the client does want to signal since the
+ring buffer state will prevent the signaling. Implement logic to
+have only one signaling policy in force for a given channel.
+
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
+Tested-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/channel.c | 18 ++++++++++++++++++
+ include/linux/hyperv.h | 18 ++++++++++++++++++
+ 2 files changed, 36 insertions(+)
+
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -630,10 +630,19 @@ int vmbus_sendpacket_ctl(struct vmbus_ch
+ * on the ring. We will not signal if more data is
+ * to be placed.
+ *
++ * Based on the channel signal state, we will decide
++ * which signaling policy will be applied.
++ *
+ * If we cannot write to the ring-buffer; signal the host
+ * even if we may not have written anything. This is a rare
+ * enough condition that it should not matter.
+ */
++
++ if (channel->signal_policy)
++ signal = true;
++ else
++ kick_q = true;
++
+ if (((ret == 0) && kick_q && signal) || (ret))
+ vmbus_setevent(channel);
+
+@@ -733,10 +742,19 @@ int vmbus_sendpacket_pagebuffer_ctl(stru
+ * on the ring. We will not signal if more data is
+ * to be placed.
+ *
++ * Based on the channel signal state, we will decide
++ * which signaling policy will be applied.
++ *
+ * If we cannot write to the ring-buffer; signal the host
+ * even if we may not have written anything. This is a rare
+ * enough condition that it should not matter.
+ */
++
++ if (channel->signal_policy)
++ signal = true;
++ else
++ kick_q = true;
++
+ if (((ret == 0) && kick_q && signal) || (ret))
+ vmbus_setevent(channel);
+
+--- a/include/linux/hyperv.h
++++ b/include/linux/hyperv.h
+@@ -630,6 +630,11 @@ struct hv_input_signal_event_buffer {
+ struct hv_input_signal_event event;
+ };
+
++enum hv_signal_policy {
++ HV_SIGNAL_POLICY_DEFAULT = 0,
++ HV_SIGNAL_POLICY_EXPLICIT,
++};
++
+ struct vmbus_channel {
+ /* Unique channel id */
+ int id;
+@@ -757,8 +762,21 @@ struct vmbus_channel {
+ * link up channels based on their CPU affinity.
+ */
+ struct list_head percpu_list;
++ /*
++ * Host signaling policy: The default policy will be
++ * based on the ring buffer state. We will also support
++ * a policy where the client driver can have explicit
++ * signaling control.
++ */
++ enum hv_signal_policy signal_policy;
+ };
+
++static inline void set_channel_signal_state(struct vmbus_channel *c,
++ enum hv_signal_policy policy)
++{
++ c->signal_policy = policy;
++}
++
+ static inline void set_channel_read_state(struct vmbus_channel *c, bool state)
+ {
+ c->batched_reading = state;
--- /dev/null
+From 12e26969b32c79018165d52caff3762135614aa1 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@suse.de>
+Date: Tue, 1 Dec 2015 15:52:36 +0100
+Subject: EDAC, mc_sysfs: Fix freeing bus' name
+
+From: Borislav Petkov <bp@suse.de>
+
+commit 12e26969b32c79018165d52caff3762135614aa1 upstream.
+
+I get the splat below when modprobing/rmmoding EDAC drivers. It happens
+because bus->name is invalid after bus_unregister() has run. The Code: section
+below corresponds to:
+
+ .loc 1 1108 0
+ movq 672(%rbx), %rax # mci_1(D)->bus, mci_1(D)->bus
+ .loc 1 1109 0
+ popq %rbx #
+
+ .loc 1 1108 0
+ movq (%rax), %rdi # _7->name,
+ jmp kfree #
+
+and %rax has some funky stuff 2030203020312030 which looks a lot like
+something walked over it.
+
+Fix that by saving the name ptr before doing stuff to string it points to.
+
+ general protection fault: 0000 [#1] SMP
+ Modules linked in: ...
+ CPU: 4 PID: 10318 Comm: modprobe Tainted: G I EN 3.12.51-11-default+ #48
+ Hardware name: HP ProLiant DL380 G7, BIOS P67 05/05/2011
+ task: ffff880311320280 ti: ffff88030da3e000 task.ti: ffff88030da3e000
+ RIP: 0010:[<ffffffffa019da92>] [<ffffffffa019da92>] edac_unregister_sysfs+0x22/0x30 [edac_core]
+ RSP: 0018:ffff88030da3fe28 EFLAGS: 00010292
+ RAX: 2030203020312030 RBX: ffff880311b4e000 RCX: 000000000000095c
+ RDX: 0000000000000001 RSI: ffff880327bb9600 RDI: 0000000000000286
+ RBP: ffff880311b4e750 R08: 0000000000000000 R09: ffffffff81296110
+ R10: 0000000000000400 R11: 0000000000000000 R12: ffff88030ba1ac68
+ R13: 0000000000000001 R14: 00000000011b02f0 R15: 0000000000000000
+ FS: 00007fc9bf8f5700(0000) GS:ffff8801a7c40000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ CR2: 0000000000403c90 CR3: 000000019ebdf000 CR4: 00000000000007e0
+ Stack:
+ Call Trace:
+ i7core_unregister_mci.isra.9
+ i7core_remove
+ pci_device_remove
+ __device_release_driver
+ driver_detach
+ bus_remove_driver
+ pci_unregister_driver
+ i7core_exit
+ SyS_delete_module
+ system_call_fastpath
+ 0x7fc9bf426536
+ Code: 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 53 48 89 fb e8 52 2a 1f e1 48 8b bb a0 02 00 00 e8 46 59 1f e1 48 8b 83 a0 02 00 00 5b <48> 8b 38 e9 26 9a fe e0 66 0f 1f 44 00 00 66 66 66 66 90 48 8b
+ RIP [<ffffffffa019da92>] edac_unregister_sysfs+0x22/0x30 [edac_core]
+ RSP <ffff88030da3fe28>
+
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Fixes: 7a623c039075 ("edac: rewrite the sysfs code to use struct device")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/edac_mc_sysfs.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -880,21 +880,26 @@ static struct device_type mci_attr_type
+ int edac_create_sysfs_mci_device(struct mem_ctl_info *mci,
+ const struct attribute_group **groups)
+ {
++ char *name;
+ int i, err;
+
+ /*
+ * The memory controller needs its own bus, in order to avoid
+ * namespace conflicts at /sys/bus/edac.
+ */
+- mci->bus->name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx);
+- if (!mci->bus->name)
++ name = kasprintf(GFP_KERNEL, "mc%d", mci->mc_idx);
++ if (!name)
+ return -ENOMEM;
+
++ mci->bus->name = name;
++
+ edac_dbg(0, "creating bus %s\n", mci->bus->name);
+
+ err = bus_register(mci->bus);
+- if (err < 0)
+- goto fail_free_name;
++ if (err < 0) {
++ kfree(name);
++ return err;
++ }
+
+ /* get the /sys/devices/system/edac subsys reference */
+ mci->dev.type = &mci_attr_type;
+@@ -961,8 +966,8 @@ fail_unregister_dimm:
+ device_unregister(&mci->dev);
+ fail_unregister_bus:
+ bus_unregister(mci->bus);
+-fail_free_name:
+- kfree(mci->bus->name);
++ kfree(name);
++
+ return err;
+ }
+
+@@ -993,10 +998,12 @@ void edac_remove_sysfs_mci_device(struct
+
+ void edac_unregister_sysfs(struct mem_ctl_info *mci)
+ {
++ const char *name = mci->bus->name;
++
+ edac_dbg(1, "Unregistering device %s\n", dev_name(&mci->dev));
+ device_unregister(&mci->dev);
+ bus_unregister(mci->bus);
+- kfree(mci->bus->name);
++ kfree(name);
+ }
+
+ static void mc_attr_release(struct device *dev)
--- /dev/null
+From fcd5c4dd8201595d4c598c9cca5e54760277d687 Mon Sep 17 00:00:00 2001
+From: Borislav Petkov <bp@suse.de>
+Date: Fri, 27 Nov 2015 10:38:38 +0100
+Subject: EDAC: Robustify workqueues destruction
+
+From: Borislav Petkov <bp@suse.de>
+
+commit fcd5c4dd8201595d4c598c9cca5e54760277d687 upstream.
+
+EDAC workqueue destruction is really fragile. We cancel delayed work
+but if it is still running and requeues itself, we still go ahead and
+destroy the workqueue and the queued work explodes when workqueue core
+attempts to run it.
+
+Make the destruction more robust by switching op_state to offline so
+that requeuing stops. Cancel any pending work *synchronously* too.
+
+ EDAC i7core: Driver loaded.
+ general protection fault: 0000 [#1] SMP
+ CPU 12
+ Modules linked in:
+ Supported: Yes
+ Pid: 0, comm: kworker/0:1 Tainted: G IE 3.0.101-0-default #1 HP ProLiant DL380 G7
+ RIP: 0010:[<ffffffff8107dcd7>] [<ffffffff8107dcd7>] __queue_work+0x17/0x3f0
+ < ... regs ...>
+ Process kworker/0:1 (pid: 0, threadinfo ffff88019def6000, task ffff88019def4600)
+ Stack:
+ ...
+ Call Trace:
+ call_timer_fn
+ run_timer_softirq
+ __do_softirq
+ call_softirq
+ do_softirq
+ irq_exit
+ smp_apic_timer_interrupt
+ apic_timer_interrupt
+ intel_idle
+ cpuidle_idle_call
+ cpu_idle
+ Code: ...
+ RIP __queue_work
+ RSP <...>
+
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/edac_device.c | 11 ++++-------
+ drivers/edac/edac_mc.c | 14 +++-----------
+ drivers/edac/edac_pci.c | 9 ++++-----
+ 3 files changed, 11 insertions(+), 23 deletions(-)
+
+--- a/drivers/edac/edac_device.c
++++ b/drivers/edac/edac_device.c
+@@ -435,16 +435,13 @@ void edac_device_workq_setup(struct edac
+ */
+ void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev)
+ {
+- int status;
+-
+ if (!edac_dev->edac_check)
+ return;
+
+- status = cancel_delayed_work(&edac_dev->work);
+- if (status == 0) {
+- /* workq instance might be running, wait for it */
+- flush_workqueue(edac_workqueue);
+- }
++ edac_dev->op_state = OP_OFFLINE;
++
++ cancel_delayed_work_sync(&edac_dev->work);
++ flush_workqueue(edac_workqueue);
+ }
+
+ /*
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -586,18 +586,10 @@ static void edac_mc_workq_setup(struct m
+ */
+ static void edac_mc_workq_teardown(struct mem_ctl_info *mci)
+ {
+- int status;
++ mci->op_state = OP_OFFLINE;
+
+- if (mci->op_state != OP_RUNNING_POLL)
+- return;
+-
+- status = cancel_delayed_work(&mci->work);
+- if (status == 0) {
+- edac_dbg(0, "not canceled, flush the queue\n");
+-
+- /* workq instance might be running, wait for it */
+- flush_workqueue(edac_workqueue);
+- }
++ cancel_delayed_work_sync(&mci->work);
++ flush_workqueue(edac_workqueue);
+ }
+
+ /*
+--- a/drivers/edac/edac_pci.c
++++ b/drivers/edac/edac_pci.c
+@@ -274,13 +274,12 @@ static void edac_pci_workq_setup(struct
+ */
+ static void edac_pci_workq_teardown(struct edac_pci_ctl_info *pci)
+ {
+- int status;
+-
+ edac_dbg(0, "\n");
+
+- status = cancel_delayed_work(&pci->work);
+- if (status == 0)
+- flush_workqueue(edac_workqueue);
++ pci->op_state = OP_OFFLINE;
++
++ cancel_delayed_work_sync(&pci->work);
++ flush_workqueue(edac_workqueue);
+ }
+
+ /*
--- /dev/null
+From 49f34134aea74f19ca016f055d25ee55ec359dee Mon Sep 17 00:00:00 2001
+From: Milo Kim <milo.kim@ti.com>
+Date: Wed, 13 Jan 2016 16:19:50 +0900
+Subject: irqchip/atmel-aic: Fix wrong bit operation for IRQ priority
+
+From: Milo Kim <milo.kim@ti.com>
+
+commit 49f34134aea74f19ca016f055d25ee55ec359dee upstream.
+
+Atmel AIC has common structure for SMR (Source Mode Register).
+
+ bit[6:5] Interrupt source type
+ bit[2:0] Priority level
+ Other bits are unused.
+
+To update new priority value, bit[2:0] should be cleared first and then
+new priority level can be written. However, aic_common_set_priority()
+helper clears source type bits instead of priority bits.
+This patch fixes wrong mask bit operation.
+
+Fixes: b1479ebb7720 "irqchip: atmel-aic: Add atmel AIC/AIC5 drivers"
+Signed-off-by: Milo Kim <milo.kim@ti.com>
+Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Ludovic Desroches <ludovic.desroches@atmel.com>
+Cc: Nicholas Ferre <nicolas.ferre@atmel.com>
+Link: http://lkml.kernel.org/r/1452669592-3401-2-git-send-email-milo.kim@ti.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-atmel-aic-common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-atmel-aic-common.c
++++ b/drivers/irqchip/irq-atmel-aic-common.c
+@@ -86,7 +86,7 @@ int aic_common_set_priority(int priority
+ priority > AT91_AIC_IRQ_MAX_PRIORITY)
+ return -EINVAL;
+
+- *val &= AT91_AIC_PRIOR;
++ *val &= ~AT91_AIC_PRIOR;
+ *val |= priority;
+
+ return 0;
--- /dev/null
+From 004fa08d7aba2a13974446bf212a48c0b3b0d9fd Mon Sep 17 00:00:00 2001
+From: Ashok Kumar <ashoks@broadcom.com>
+Date: Thu, 11 Feb 2016 05:38:53 -0800
+Subject: irqchip/gic-v3-its: Fix double ICC_EOIR write for LPI in EOImode==1
+
+From: Ashok Kumar <ashoks@broadcom.com>
+
+commit 004fa08d7aba2a13974446bf212a48c0b3b0d9fd upstream.
+
+When the GIC is using EOImode==1, the EOI is done immediately,
+leaving the deactivation to be performed when the EOI was
+previously done.
+
+Unfortunately, the ITS is not aware of the EOImode at all, and
+blindly EOIs the interrupt again. On most systems, this is ignored
+(despite being a programming error), but some others do raise a
+SError exception as there is no priority drop to perform for this
+interrupt.
+
+The fix is to stop trying to be clever, and always call into the
+underlying GIC to perform the right access, irrespective of the
+more we're in.
+
+[Marc: Reworked commit message]
+
+Fixes: 0b996fd35957a ("irqchip/GICv3: Convert to EOImode == 1")
+Acked-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Ashok Kumar <ashoks@broadcom.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-gic-v3-its.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -597,11 +597,6 @@ static void its_unmask_irq(struct irq_da
+ lpi_set_config(d, true);
+ }
+
+-static void its_eoi_irq(struct irq_data *d)
+-{
+- gic_write_eoir(d->hwirq);
+-}
+-
+ static int its_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+ bool force)
+ {
+@@ -638,7 +633,7 @@ static struct irq_chip its_irq_chip = {
+ .name = "ITS",
+ .irq_mask = its_mask_irq,
+ .irq_unmask = its_unmask_irq,
+- .irq_eoi = its_eoi_irq,
++ .irq_eoi = irq_chip_eoi_parent,
+ .irq_set_affinity = its_set_affinity,
+ .irq_compose_msi_msg = its_irq_compose_msi_msg,
+ };
--- /dev/null
+From c5b635203032462603c503ecce91a7021c1ad44a Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <linux@rempel-privat.de>
+Date: Fri, 29 Jan 2016 10:57:53 +0100
+Subject: irqchip/mxs: Add missing set_handle_irq()
+
+From: Oleksij Rempel <linux@rempel-privat.de>
+
+commit c5b635203032462603c503ecce91a7021c1ad44a upstream.
+
+The rework of the driver missed to move the call to set_handle_irq() into
+asm9260_of_init(). As a consequence no interrupt entry point is installed and
+no interrupts are delivered
+
+Solution is simple: Install the interrupt entry handler.
+
+Fixes: 7e4ac676ee ("irqchip/mxs: Add Alphascale ASM9260 support")
+Signed-off-by: Oleksij Rempel <linux@rempel-privat.de>
+Cc: kernel@pengutronix.de
+Cc: jason@lakedaemon.net
+Cc: marc.zyngier@arm.com
+Link: http://lkml.kernel.org/r/1454061473-24957-1-git-send-email-linux@rempel-privat.de
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-mxs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/irqchip/irq-mxs.c
++++ b/drivers/irqchip/irq-mxs.c
+@@ -241,6 +241,7 @@ static int __init asm9260_of_init(struct
+ writel(0, icoll_priv.intr + i);
+
+ icoll_add_domain(np, ASM9260_NUM_IRQS);
++ set_handle_irq(icoll_handle_irq);
+
+ return 0;
+ }
--- /dev/null
+From d3b421cd07e4c0d4d6c0bbd55ca169c054fc081d Mon Sep 17 00:00:00 2001
+From: Sekhar Nori <nsekhar@ti.com>
+Date: Tue, 15 Dec 2015 19:56:12 +0530
+Subject: irqchip/omap-intc: Add support for spurious irq handling
+
+From: Sekhar Nori <nsekhar@ti.com>
+
+commit d3b421cd07e4c0d4d6c0bbd55ca169c054fc081d upstream.
+
+Under some conditions, irq sorting procedure used by INTC can go wrong
+resulting in a spurious irq getting reported.
+
+If this condition is not handled, it results in endless stream of:
+
+ unexpected IRQ trap at vector 00
+
+messages from ack_bad_irq()
+
+Handle the spurious interrupt condition in omap-intc driver to prevent this.
+
+Measurements using kernel function profiler on AM335x EVM running at 720MHz
+show that after this patch omap_intc_handle_irq() takes about 37.4us against
+34us before this patch.
+
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Cc: John Ogness <john.ogness@linutronix.de>
+Cc: Felipe Balbi <balbi@ti.com>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Link: http://lkml.kernel.org/r/9c78a6db02ac55f7af7371b417b6e414d2c3095b.1450188128.git.nsekhar@ti.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-omap-intc.c | 27 ++++++++++++++++++++++++++-
+ 1 file changed, 26 insertions(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-omap-intc.c
++++ b/drivers/irqchip/irq-omap-intc.c
+@@ -47,6 +47,7 @@
+ #define INTC_ILR0 0x0100
+
+ #define ACTIVEIRQ_MASK 0x7f /* omap2/3 active interrupt bits */
++#define SPURIOUSIRQ_MASK (0x1ffffff << 7)
+ #define INTCPS_NR_ILR_REGS 128
+ #define INTCPS_NR_MIR_REGS 4
+
+@@ -330,11 +331,35 @@ static int __init omap_init_irq(u32 base
+ static asmlinkage void __exception_irq_entry
+ omap_intc_handle_irq(struct pt_regs *regs)
+ {
++ extern unsigned long irq_err_count;
+ u32 irqnr;
+
+ irqnr = intc_readl(INTC_SIR);
++
++ /*
++ * A spurious IRQ can result if interrupt that triggered the
++ * sorting is no longer active during the sorting (10 INTC
++ * functional clock cycles after interrupt assertion). Or a
++ * change in interrupt mask affected the result during sorting
++ * time. There is no special handling required except ignoring
++ * the SIR register value just read and retrying.
++ * See section 6.2.5 of AM335x TRM Literature Number: SPRUH73K
++ *
++ * Many a times, a spurious interrupt situation has been fixed
++ * by adding a flush for the posted write acking the IRQ in
++ * the device driver. Typically, this is going be the device
++ * driver whose interrupt was handled just before the spurious
++ * IRQ occurred. Pay attention to those device drivers if you
++ * run into hitting the spurious IRQ condition below.
++ */
++ if (unlikely((irqnr & SPURIOUSIRQ_MASK) == SPURIOUSIRQ_MASK)) {
++ pr_err_once("%s: spurious irq!\n", __func__);
++ irq_err_count++;
++ omap_ack_irq(NULL);
++ return;
++ }
++
+ irqnr &= ACTIVEIRQ_MASK;
+- WARN_ONCE(!irqnr, "Spurious IRQ ?\n");
+ handle_domain_irq(domain, irqnr, regs);
+ }
+
--- /dev/null
+From f4dce1ffd2e30fa31756876ef502ce6d2324be35 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Mon, 25 Jan 2016 20:32:03 +0000
+Subject: MIPS: Fix buffer overflow in syscall_get_arguments()
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit f4dce1ffd2e30fa31756876ef502ce6d2324be35 upstream.
+
+Since commit 4c21b8fd8f14 ("MIPS: seccomp: Handle indirect system calls
+(o32)"), syscall_get_arguments() attempts to handle o32 indirect syscall
+arguments by incrementing both the start argument number and the number
+of arguments to fetch. However only the start argument number needs to
+be incremented. The number of arguments does not change, they're just
+shifted up by one, and in fact the output array is provided by the
+caller and is likely only n entries long, so reading more arguments
+overflows the output buffer.
+
+In the case of seccomp, this results in it fetching 7 arguments starting
+at the 2nd one, which overflows the unsigned long args[6] in
+populate_seccomp_data(). This clobbers the $s0 register from
+syscall_trace_enter() which __seccomp_phase1_filter() saved onto the
+stack, into which syscall_trace_enter() had placed its syscall number
+argument. This caused Chromium to crash.
+
+Credit goes to Milko for tracking it down as far as $s0 being clobbered.
+
+Fixes: 4c21b8fd8f14 ("MIPS: seccomp: Handle indirect system calls (o32)")
+Reported-by: Milko Leporis <milko.leporis@imgtec.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/12213/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/syscall.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/arch/mips/include/asm/syscall.h
++++ b/arch/mips/include/asm/syscall.h
+@@ -101,10 +101,8 @@ static inline void syscall_get_arguments
+ /* O32 ABI syscall() - Either 64-bit with O32 or 32-bit */
+ if ((config_enabled(CONFIG_32BIT) ||
+ test_tsk_thread_flag(task, TIF_32BIT_REGS)) &&
+- (regs->regs[2] == __NR_syscall)) {
++ (regs->regs[2] == __NR_syscall))
+ i++;
+- n++;
+- }
+
+ while (n--)
+ ret |= mips_get_syscall_arg(args++, task, regs, i++);
--- /dev/null
+From 4f33f6c522948fffc345261896042b58dea23754 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Thu, 21 Jan 2016 21:09:52 +0800
+Subject: MIPS: Fix some missing CONFIG_CPU_MIPSR6 #ifdefs
+
+From: Huacai Chen <chenhc@lemote.com>
+
+commit 4f33f6c522948fffc345261896042b58dea23754 upstream.
+
+Commit be0c37c985eddc4 (MIPS: Rearrange PTE bits into fixed positions.)
+defines fixed PTE bits for MIPS R2. Then, commit d7b631419b3d230a4d383
+(MIPS: pgtable-bits: Fix XPA damage to R6 definitions.) adds the MIPS
+R6 definitions in the same way as MIPS R2. But some R6 #ifdefs in the
+later commit are missing, so in this patch I fix that.
+
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Cc: Aurelien Jarno <aurelien@aurel32.net>
+Cc: Steven J. Hill <Steven.Hill@imgtec.com>
+Cc: Fuxin Zhang <zhangfx@lemote.com>
+Cc: Zhangjin Wu <wuzhangjin@gmail.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/12164/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/pgtable.h | 4 ++--
+ arch/mips/mm/tlbex.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/include/asm/pgtable.h
++++ b/arch/mips/include/asm/pgtable.h
+@@ -353,7 +353,7 @@ static inline pte_t pte_mkdirty(pte_t pt
+ static inline pte_t pte_mkyoung(pte_t pte)
+ {
+ pte_val(pte) |= _PAGE_ACCESSED;
+-#ifdef CONFIG_CPU_MIPSR2
++#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
+ if (!(pte_val(pte) & _PAGE_NO_READ))
+ pte_val(pte) |= _PAGE_SILENT_READ;
+ else
+@@ -560,7 +560,7 @@ static inline pmd_t pmd_mkyoung(pmd_t pm
+ {
+ pmd_val(pmd) |= _PAGE_ACCESSED;
+
+-#ifdef CONFIG_CPU_MIPSR2
++#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
+ if (!(pmd_val(pmd) & _PAGE_NO_READ))
+ pmd_val(pmd) |= _PAGE_SILENT_READ;
+ else
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -242,7 +242,7 @@ static void output_pgtable_bits_defines(
+ pr_define("_PAGE_HUGE_SHIFT %d\n", _PAGE_HUGE_SHIFT);
+ pr_define("_PAGE_SPLITTING_SHIFT %d\n", _PAGE_SPLITTING_SHIFT);
+ #endif
+-#ifdef CONFIG_CPU_MIPSR2
++#if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
+ if (cpu_has_rixi) {
+ #ifdef _PAGE_NO_EXEC_SHIFT
+ pr_define("_PAGE_NO_EXEC_SHIFT %d\n", _PAGE_NO_EXEC_SHIFT);
--- /dev/null
+From 5610b1254e3689b6ef8ebe2db260709a74da06c8 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Thu, 21 Jan 2016 21:09:50 +0800
+Subject: MIPS: hpet: Choose a safe value for the ETIME check
+
+From: Huacai Chen <chenhc@lemote.com>
+
+commit 5610b1254e3689b6ef8ebe2db260709a74da06c8 upstream.
+
+This patch is borrowed from x86 hpet driver and explaind below:
+
+Due to the overly intelligent design of HPETs, we need to workaround
+the problem that the compare value which we write is already behind
+the actual counter value at the point where the value hits the real
+compare register. This happens for two reasons:
+
+1) We read out the counter, add the delta and write the result to the
+ compare register. When a NMI hits between the read out and the write
+ then the counter can be ahead of the event already.
+
+2) The write to the compare register is delayed by up to two HPET
+ cycles in AMD chipsets.
+
+We can work around this by reading back the compare register to make
+sure that the written value has hit the hardware. But that is bad
+performance wise for the normal case where the event is far enough in
+the future.
+
+As we already know that the write can be delayed by up to two cycles
+we can avoid the read back of the compare register completely if we
+make the decision whether the delta has elapsed already or not based
+on the following calculation:
+
+ cmp = event - actual_count;
+
+If cmp is less than 64 HPET clock cycles, then we decide that the event
+has happened already and return -ETIME. That covers the above #1 and #2
+problems which would cause a wait for HPET wraparound (~306 seconds).
+
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Cc: Aurelien Jarno <aurelien@aurel32.net>
+Cc: Steven J. Hill <Steven.Hill@imgtec.com>
+Cc: Fuxin Zhang <zhangfx@lemote.com>
+Cc: Zhangjin Wu <wuzhangjin@gmail.com>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/12162/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/loongson64/loongson-3/hpet.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/loongson64/loongson-3/hpet.c
++++ b/arch/mips/loongson64/loongson-3/hpet.c
+@@ -13,6 +13,9 @@
+ #define SMBUS_PCI_REG64 0x64
+ #define SMBUS_PCI_REGB4 0xb4
+
++#define HPET_MIN_CYCLES 64
++#define HPET_MIN_PROG_DELTA (HPET_MIN_CYCLES + (HPET_MIN_CYCLES >> 1))
++
+ static DEFINE_SPINLOCK(hpet_lock);
+ DEFINE_PER_CPU(struct clock_event_device, hpet_clockevent_device);
+
+@@ -161,8 +164,9 @@ static int hpet_next_event(unsigned long
+ cnt += delta;
+ hpet_write(HPET_T0_CMP, cnt);
+
+- res = ((int)(hpet_read(HPET_COUNTER) - cnt) > 0) ? -ETIME : 0;
+- return res;
++ res = (int)(cnt - hpet_read(HPET_COUNTER));
++
++ return res < HPET_MIN_CYCLES ? -ETIME : 0;
+ }
+
+ static irqreturn_t hpet_irq_handler(int irq, void *data)
+@@ -237,7 +241,7 @@ void __init setup_hpet_timer(void)
+ cd->cpumask = cpumask_of(cpu);
+ clockevent_set_clock(cd, HPET_FREQ);
+ cd->max_delta_ns = clockevent_delta2ns(0x7fffffff, cd);
+- cd->min_delta_ns = 5000;
++ cd->min_delta_ns = clockevent_delta2ns(HPET_MIN_PROG_DELTA, cd);
+
+ clockevents_register_device(cd);
+ setup_irq(HPET_T0_IRQ, &hpet_irq);
--- /dev/null
+From 5754843225f78ac7cbe142a6899890a9733a5a5d Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Thu, 21 Jan 2016 21:09:49 +0800
+Subject: MIPS: Loongson-3: Fix SMP_ASK_C0COUNT IPI handler
+
+From: Huacai Chen <chenhc@lemote.com>
+
+commit 5754843225f78ac7cbe142a6899890a9733a5a5d upstream.
+
+When Core-0 handle SMP_ASK_C0COUNT IPI, we should make other cores to
+see the result as soon as possible (especially when Store-Fill-Buffer
+is enabled). Otherwise, C0_Count syncronization makes no sense.
+
+BTW, array is more suitable than per-cpu variable for syncronization,
+and there is a corner case should be avoid: C0_Count of Core-0 can be
+really 0.
+
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Cc: Aurelien Jarno <aurelien@aurel32.net>
+Cc: Steven J. Hill <Steven.Hill@imgtec.com>
+Cc: Fuxin Zhang <zhangfx@lemote.com>
+Cc: Zhangjin Wu <wuzhangjin@gmail.com>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/12160/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/loongson64/loongson-3/smp.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/arch/mips/loongson64/loongson-3/smp.c
++++ b/arch/mips/loongson64/loongson-3/smp.c
+@@ -30,13 +30,13 @@
+ #include "smp.h"
+
+ DEFINE_PER_CPU(int, cpu_state);
+-DEFINE_PER_CPU(uint32_t, core0_c0count);
+
+ static void *ipi_set0_regs[16];
+ static void *ipi_clear0_regs[16];
+ static void *ipi_status0_regs[16];
+ static void *ipi_en0_regs[16];
+ static void *ipi_mailbox_buf[16];
++static uint32_t core0_c0count[NR_CPUS];
+
+ /* read a 32bit value from ipi register */
+ #define loongson3_ipi_read32(addr) readl(addr)
+@@ -275,12 +275,14 @@ void loongson3_ipi_interrupt(struct pt_r
+ if (action & SMP_ASK_C0COUNT) {
+ BUG_ON(cpu != 0);
+ c0count = read_c0_count();
+- for (i = 1; i < num_possible_cpus(); i++)
+- per_cpu(core0_c0count, i) = c0count;
++ c0count = c0count ? c0count : 1;
++ for (i = 1; i < nr_cpu_ids; i++)
++ core0_c0count[i] = c0count;
++ __wbflush(); /* Let others see the result ASAP */
+ }
+ }
+
+-#define MAX_LOOPS 1111
++#define MAX_LOOPS 800
+ /*
+ * SMP init and finish on secondary CPUs
+ */
+@@ -305,16 +307,20 @@ static void loongson3_init_secondary(voi
+ cpu_logical_map(cpu) / loongson_sysconf.cores_per_package;
+
+ i = 0;
+- __this_cpu_write(core0_c0count, 0);
++ core0_c0count[cpu] = 0;
+ loongson3_send_ipi_single(0, SMP_ASK_C0COUNT);
+- while (!__this_cpu_read(core0_c0count)) {
++ while (!core0_c0count[cpu]) {
+ i++;
+ cpu_relax();
+ }
+
+ if (i > MAX_LOOPS)
+ i = MAX_LOOPS;
+- initcount = __this_cpu_read(core0_c0count) + i;
++ if (cpu_data[cpu].package)
++ initcount = core0_c0count[cpu] + i;
++ else /* Local access is faster for loops */
++ initcount = core0_c0count[cpu] + i/2;
++
+ write_c0_count(initcount);
+ }
+
--- /dev/null
+From e10c321977091f163eceedec0650e0ef4b3cf4bb Mon Sep 17 00:00:00 2001
+From: Carlo Caione <carlo@endlessm.com>
+Date: Wed, 13 Jan 2016 09:36:55 +0100
+Subject: mmc: core: Enable tuning according to the actual timing
+
+From: Carlo Caione <carlo@endlessm.com>
+
+commit e10c321977091f163eceedec0650e0ef4b3cf4bb upstream.
+
+While in sdhci_execute_tuning() the choice whether or not to enable the
+tuning is done on the actual timing, in the mmc_sdio_init_uhs_card() the
+check is done on the capability of the card.
+
+This difference is causing some issues with some SDIO cards in DDR50
+mode where the CDM19 is wrongly issued.
+
+With this patch we modify the check in both
+mmc_(sd|sdio)_init_uhs_card() functions to take the proper decision
+only according to the actual timing specification.
+
+Signed-off-by: Carlo Caione <carlo@endlessm.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/sd.c | 8 ++++----
+ drivers/mmc/core/sdio.c | 4 ++--
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -626,9 +626,9 @@ static int mmc_sd_init_uhs_card(struct m
+ * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104.
+ */
+ if (!mmc_host_is_spi(card->host) &&
+- (card->sd_bus_speed == UHS_SDR50_BUS_SPEED ||
+- card->sd_bus_speed == UHS_DDR50_BUS_SPEED ||
+- card->sd_bus_speed == UHS_SDR104_BUS_SPEED)) {
++ (card->host->ios.timing == MMC_TIMING_UHS_SDR50 ||
++ card->host->ios.timing == MMC_TIMING_UHS_DDR50 ||
++ card->host->ios.timing == MMC_TIMING_UHS_SDR104)) {
+ err = mmc_execute_tuning(card);
+
+ /*
+@@ -638,7 +638,7 @@ static int mmc_sd_init_uhs_card(struct m
+ * difference between v3.00 and 3.01 spec means that CMD19
+ * tuning is also available for DDR50 mode.
+ */
+- if (err && card->sd_bus_speed == UHS_DDR50_BUS_SPEED) {
++ if (err && card->host->ios.timing == MMC_TIMING_UHS_DDR50) {
+ pr_warn("%s: ddr50 tuning failed\n",
+ mmc_hostname(card->host));
+ err = 0;
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -535,8 +535,8 @@ static int mmc_sdio_init_uhs_card(struct
+ * SDR104 mode SD-cards. Note that tuning is mandatory for SDR104.
+ */
+ if (!mmc_host_is_spi(card->host) &&
+- ((card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR50) ||
+- (card->sw_caps.sd3_bus_mode & SD_MODE_UHS_SDR104)))
++ ((card->host->ios.timing == MMC_TIMING_UHS_SDR50) ||
++ (card->host->ios.timing == MMC_TIMING_UHS_SDR104)))
+ err = mmc_execute_tuning(card);
+ out:
+ return err;
--- /dev/null
+From adb24d42a516bca8b9741ed21206509daaab5b13 Mon Sep 17 00:00:00 2001
+From: Wenkai Du <wenkai.du@intel.com>
+Date: Thu, 26 Nov 2015 14:00:44 +0200
+Subject: mmc: mmc: Fix incorrect use of driver strength switching HS200 and HS400
+
+From: Wenkai Du <wenkai.du@intel.com>
+
+commit adb24d42a516bca8b9741ed21206509daaab5b13 upstream.
+
+Commit cc4f414c885c ("mmc: mmc: Add driver strength selection")
+added driver strength selection for eMMC HS200 and HS400 modes.
+That patch also set the driver stength when transitioning through
+High Speed mode to HS200/HS400, but driver strength is not defined
+for High Speed mode. While the JEDEC specification is not clear
+on this point it has been observed to cause problems for some eMMC,
+and removing the driver strength setting in this case makes it
+consistent with the normal use of High Speed mode.
+
+Signed-off-by: Wenkai Du <wenkai.du@intel.com>
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/mmc.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1076,8 +1076,7 @@ static int mmc_select_hs400(struct mmc_c
+ mmc_set_clock(host, max_dtr);
+
+ /* Switch card to HS mode */
+- val = EXT_CSD_TIMING_HS |
+- card->drive_strength << EXT_CSD_DRV_STR_SHIFT;
++ val = EXT_CSD_TIMING_HS;
+ err = __mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
+ EXT_CSD_HS_TIMING, val,
+ card->ext_csd.generic_cmd6_time,
+@@ -1160,8 +1159,7 @@ int mmc_hs400_to_hs200(struct mmc_card *
+ mmc_set_clock(host, max_dtr);
+
+ /* Switch HS400 to HS DDR */
+- val = EXT_CSD_TIMING_HS |
+- card->drive_strength << EXT_CSD_DRV_STR_SHIFT;
++ val = EXT_CSD_TIMING_HS;
+ err = __mmc_switch(card, EXT_CSD_CMD_SET_NORMAL, EXT_CSD_HS_TIMING,
+ val, card->ext_csd.generic_cmd6_time,
+ true, send_status, true);
--- /dev/null
+From 0bcb7efdff63564e80fe84dd36a9fbdfbf6697a4 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 4 Jan 2016 02:21:55 +0100
+Subject: mmc: mmci: fix an ages old detection error
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit 0bcb7efdff63564e80fe84dd36a9fbdfbf6697a4 upstream.
+
+commit 4956e10903fd ("ARM: 6244/1: mmci: add variant data and default
+MCICLOCK support") added variant data for ARM, U300 and Ux500 variants.
+The Nomadik NHK8815/8820 variant was erroneously labeled as a U300
+variant, and when the proper Nomadik variant was later introduced in
+commit 34fd421349ff ("ARM: 7378/1: mmci: add support for the Nomadik MMCI
+variant") this was not fixes. Let's say this fixes the latter commit as
+there was no proper Nomadik support until then.
+
+Fixes: 34fd421349ff ("ARM: 7378/1: mmci: add support for the Nomadik...")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/mmci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/mmci.c
++++ b/drivers/mmc/host/mmci.c
+@@ -1886,7 +1886,7 @@ static struct amba_id mmci_ids[] = {
+ {
+ .id = 0x00280180,
+ .mask = 0x00ffffff,
+- .data = &variant_u300,
++ .data = &variant_nomadik,
+ },
+ {
+ .id = 0x00480180,
--- /dev/null
+From 41c89159a6ae5472d39ed8bded5b3b4e07a37944 Mon Sep 17 00:00:00 2001
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+Date: Fri, 29 Jan 2016 00:21:26 +0100
+Subject: mmc: pxamci: fix again read-only gpio detection polarity
+
+From: Robert Jarzmik <robert.jarzmik@free.fr>
+
+commit 41c89159a6ae5472d39ed8bded5b3b4e07a37944 upstream.
+
+The commit fixing the conversion of pxamci to slot-gpio API fixed the
+inverted the logic of the read-only gpio. Unfortunately, the commit was
+tested on a non-inverted gpio, and not on the inverted one. And the fix
+did work partially, by luck.
+
+This is the remaining missing part of the fix, trivial but still necessary.
+
+Fixes: Fixes: 26d49fe71953 ("mmc: pxamci: fix read-only gpio detection polarity")
+Reported-by: Andrea Adami <andrea.adami@gmail.com>
+Tested-by: Andrea Adami <andrea.adami@gmail.com>
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/pxamci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/pxamci.c
++++ b/drivers/mmc/host/pxamci.c
+@@ -804,7 +804,7 @@ static int pxamci_probe(struct platform_
+ dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro);
+ goto out;
+ } else {
+- mmc->caps |= host->pdata->gpio_card_ro_invert ?
++ mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
+ 0 : MMC_CAP2_RO_ACTIVE_HIGH;
+ }
+
--- /dev/null
+From 6a645dd87a5a506779810d7d9935c25fc2ef4687 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Tue, 9 Feb 2016 16:12:38 +0200
+Subject: mmc: sdhci-acpi: Fix card detect race for Intel BXT/APL
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 6a645dd87a5a506779810d7d9935c25fc2ef4687 upstream.
+
+Intel BXT/APL use a card detect GPIO however the host controller
+will not enable bus power unless it's card detect also reflects
+the presence of a card. Unfortunately those 2 things race which
+can result in commands not starting, after which the controller
+does nothing and there is a 10 second wait for the driver's
+10-second timer to timeout.
+
+That is fixed by having the driver look also at the present state
+register to determine if the card is present. Consequently, provide
+a 'get_cd' mmc host operation for BXT/APL that does that.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-acpi.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -146,6 +146,33 @@ static const struct sdhci_acpi_chip sdhc
+ .ops = &sdhci_acpi_ops_int,
+ };
+
++static int bxt_get_cd(struct mmc_host *mmc)
++{
++ int gpio_cd = mmc_gpio_get_cd(mmc);
++ struct sdhci_host *host = mmc_priv(mmc);
++ unsigned long flags;
++ int ret = 0;
++
++ if (!gpio_cd)
++ return 0;
++
++ pm_runtime_get_sync(mmc->parent);
++
++ spin_lock_irqsave(&host->lock, flags);
++
++ if (host->flags & SDHCI_DEVICE_DEAD)
++ goto out;
++
++ ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT);
++out:
++ spin_unlock_irqrestore(&host->lock, flags);
++
++ pm_runtime_mark_last_busy(mmc->parent);
++ pm_runtime_put_autosuspend(mmc->parent);
++
++ return ret;
++}
++
+ static int sdhci_acpi_emmc_probe_slot(struct platform_device *pdev,
+ const char *hid, const char *uid)
+ {
+@@ -196,6 +223,9 @@ static int sdhci_acpi_sd_probe_slot(stru
+
+ /* Platform specific code during sd probe slot goes here */
+
++ if (hid && !strcmp(hid, "80865ACA"))
++ host->mmc_host_ops.get_cd = bxt_get_cd;
++
+ return 0;
+ }
+
--- /dev/null
+From 8d28b7a72fe18bcdcdb047243ba8fec36b149955 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Tue, 9 Feb 2016 16:12:36 +0200
+Subject: mmc: sdhci: Allow override of get_cd() called from sdhci_request()
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 8d28b7a72fe18bcdcdb047243ba8fec36b149955 upstream.
+
+Drivers may need to provide their own get_cd() mmc host op, but
+currently the internals of the current op (sdhci_get_cd()) are
+provided by sdhci_do_get_cd() which is also called from
+sdhci_request().
+
+To allow override of the get_cd functionality, change sdhci_request()
+to call ->get_cd() instead of sdhci_do_get_cd().
+
+Note, in the future the call to ->get_cd() will likely be removed
+from sdhci_request() since most drivers don't need actually it.
+However this change is being done now to facilitate a subsequent
+bug fix.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -1367,7 +1367,7 @@ static void sdhci_request(struct mmc_hos
+ sdhci_runtime_pm_get(host);
+
+ /* Firstly check card presence */
+- present = sdhci_do_get_cd(host);
++ present = mmc->ops->get_cd(mmc);
+
+ spin_lock_irqsave(&host->lock, flags);
+
--- /dev/null
+From bf60e592a1af4d6f65dd54593250183f14360eed Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Tue, 9 Feb 2016 16:12:35 +0200
+Subject: mmc: sdhci: Allow override of mmc host operations
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit bf60e592a1af4d6f65dd54593250183f14360eed upstream.
+
+In the past, fixes for specific hardware devices were implemented
+in sdhci using quirks. That approach is no longer accepted because
+the growing number of quirks was starting to make the code difficult
+to understand and maintain.
+
+One alternative to quirks, is to allow drivers to override the default
+mmc host operations. This patch makes it easy to do that, and it is
+needed for a subsequent bug fix, for which separate patches are
+provided.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 3 ++-
+ drivers/mmc/host/sdhci.h | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2864,6 +2864,8 @@ struct sdhci_host *sdhci_alloc_host(stru
+
+ host = mmc_priv(mmc);
+ host->mmc = mmc;
++ host->mmc_host_ops = sdhci_ops;
++ mmc->ops = &host->mmc_host_ops;
+
+ return host;
+ }
+@@ -3060,7 +3062,6 @@ int sdhci_add_host(struct sdhci_host *ho
+ /*
+ * Set host parameters.
+ */
+- mmc->ops = &sdhci_ops;
+ max_clk = host->max_clk;
+
+ if (host->ops->get_min_clock)
+--- a/drivers/mmc/host/sdhci.h
++++ b/drivers/mmc/host/sdhci.h
+@@ -425,6 +425,7 @@ struct sdhci_host {
+
+ /* Internal data */
+ struct mmc_host *mmc; /* MMC structure */
++ struct mmc_host_ops mmc_host_ops; /* MMC host ops */
+ u64 dma_mask; /* custom DMA mask */
+
+ #if defined(CONFIG_LEDS_CLASS) || defined(CONFIG_LEDS_CLASS_MODULE)
--- /dev/null
+From 347ea32dc118326c4f2636928239a29d192cc9b8 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 26 Nov 2015 14:00:48 +0200
+Subject: mmc: sdhci: Fix DMA descriptor with zero data length
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 347ea32dc118326c4f2636928239a29d192cc9b8 upstream.
+
+SDHCI has built-in DMA called ADMA2. ADMA2 uses a descriptor
+table to define DMA scatter-gather. Each desciptor can specify
+a data length up to 65536 bytes, however the length field is
+only 16-bits so zero means 65536. Consequently, putting zero
+when the size is zero must not be allowed. This patch fixes
+one case where zero data length could be set inadvertently.
+
+The problem happens because unaligned data gets split and the
+code did not consider that the remaining aligned portion might
+be zero length. That case really only happens for SDIO because
+SD and eMMC cards transfer blocks that are invariably sector-
+aligned. For SDIO, access to function registers is done by
+data transfer (CMD53) when the register is bigger than 1 byte.
+Generally registers are 4 bytes but 2-byte registers are possible.
+So DMA of 4 bytes or less can happen. When 32-bit DMA is used,
+the data alignment must be 4, so 4-byte transfers won't casue a
+problem, but a 2-byte transfer could. However with the introduction
+of 64-bit DMA, the data alignment for 64-bit DMA was made 8 bytes,
+so all 4-byte transfers not on 8-byte boundaries get "split" into
+a 4-byte chunk and a 0-byte chunk, thereby hitting the bug.
+
+In fact, a closer look at the SDHCI specs indicates that only the
+descriptor table requires 8-byte alignment for 64-bit DMA. That
+will be dealt with in a separate patch, but the potential for a
+2-byte access remains, so this fix is needed anyway.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -540,9 +540,12 @@ static int sdhci_adma_table_pre(struct s
+
+ BUG_ON(len > 65536);
+
+- /* tran, valid */
+- sdhci_adma_write_desc(host, desc, addr, len, ADMA2_TRAN_VALID);
+- desc += host->desc_sz;
++ if (len) {
++ /* tran, valid */
++ sdhci_adma_write_desc(host, desc, addr, len,
++ ADMA2_TRAN_VALID);
++ desc += host->desc_sz;
++ }
+
+ /*
+ * If this triggers then we have a calculation bug
--- /dev/null
+From 5c671c410c8704800f4f1673b6f572137e7e6ddd Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 26 Nov 2015 14:00:50 +0200
+Subject: mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 5c671c410c8704800f4f1673b6f572137e7e6ddd upstream.
+
+sdhci has a legacy facility to prevent runtime suspend if the
+bus power is on. This is needed in cases where the power to
+the card is dependent on the bus power. It is controlled by
+a pair of functions: sdhci_runtime_pm_bus_on() and
+sdhci_runtime_pm_bus_off(). These functions use a boolean
+variable 'bus_on' to ensure changes are always paired.
+There is an additional check for 'runtime_suspended' which is
+the problem. In fact, its use is ill-conceived as the only
+requirement for the logic is that 'on' and 'off' are paired,
+which is actually broken by the check, for example if the bus
+power is turned on during runtime resume. So remove the check.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -2763,7 +2763,7 @@ static int sdhci_runtime_pm_put(struct s
+
+ static void sdhci_runtime_pm_bus_on(struct sdhci_host *host)
+ {
+- if (host->runtime_suspended || host->bus_on)
++ if (host->bus_on)
+ return;
+ host->bus_on = true;
+ pm_runtime_get_noresume(host->mmc->parent);
+@@ -2771,7 +2771,7 @@ static void sdhci_runtime_pm_bus_on(stru
+
+ static void sdhci_runtime_pm_bus_off(struct sdhci_host *host)
+ {
+- if (host->runtime_suspended || !host->bus_on)
++ if (!host->bus_on)
+ return;
+ host->bus_on = false;
+ pm_runtime_put_noidle(host->mmc->parent);
--- /dev/null
+From 1ca896856281d3f1ad4f6f7d4e32e2943452de23 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 26 Nov 2015 14:00:45 +0200
+Subject: mmc: sdhci-pci: Do not default to 33 Ohm driver strength for Intel SPT
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 1ca896856281d3f1ad4f6f7d4e32e2943452de23 upstream.
+
+In some cases, the stronger 33 Ohm driver strength must not be used
+so it is not a suitable default. Change it to the standard default
+50 Ohm value.
+
+The patch applies to v4.2+ except the file name changed. It is
+drivers/mmc/host/sdhci-pci.c prior to v.4.4.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pci-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -277,7 +277,7 @@ static int spt_select_drive_strength(str
+ if (sdhci_pci_spt_drive_strength > 0)
+ drive_strength = sdhci_pci_spt_drive_strength & 0xf;
+ else
+- drive_strength = 1; /* 33-ohm */
++ drive_strength = 0; /* Default 50-ohm */
+
+ if ((mmc_driver_type_mask(drive_strength) & card_drv) == 0)
+ drive_strength = 0; /* Default 50-ohm */
--- /dev/null
+From 163cbe31e5163459908a41a2b4e0d33a28fd557a Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Tue, 9 Feb 2016 16:12:37 +0200
+Subject: mmc: sdhci-pci: Fix card detect race for Intel BXT/APL
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit 163cbe31e5163459908a41a2b4e0d33a28fd557a upstream.
+
+Intel BXT/APL use a card detect GPIO however the host controller
+will not enable bus power unless it's card detect also reflects
+the presence of a card. Unfortunately those 2 things race which
+can result in commands not starting, after which the controller
+does nothing and there is a 10 second wait for the driver's
+10-second timer to timeout.
+
+That is fixed by having the driver look also at the present state
+register to determine if the card is present. Consequently, provide
+a 'get_cd' mmc host operation for BXT/APL that does that.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-pci-core.c | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -330,6 +330,33 @@ static void spt_read_drive_strength(stru
+ sdhci_pci_spt_drive_strength = 0x10 | ((val >> 12) & 0xf);
+ }
+
++static int bxt_get_cd(struct mmc_host *mmc)
++{
++ int gpio_cd = mmc_gpio_get_cd(mmc);
++ struct sdhci_host *host = mmc_priv(mmc);
++ unsigned long flags;
++ int ret = 0;
++
++ if (!gpio_cd)
++ return 0;
++
++ pm_runtime_get_sync(mmc->parent);
++
++ spin_lock_irqsave(&host->lock, flags);
++
++ if (host->flags & SDHCI_DEVICE_DEAD)
++ goto out;
++
++ ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT);
++out:
++ spin_unlock_irqrestore(&host->lock, flags);
++
++ pm_runtime_mark_last_busy(mmc->parent);
++ pm_runtime_put_autosuspend(mmc->parent);
++
++ return ret;
++}
++
+ static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot)
+ {
+ slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE |
+@@ -362,6 +389,10 @@ static int byt_sd_probe_slot(struct sdhc
+ slot->cd_con_id = NULL;
+ slot->cd_idx = 0;
+ slot->cd_override_level = true;
++ if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD ||
++ slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD)
++ slot->host->mmc_host_ops.get_cd = bxt_get_cd;
++
+ return 0;
+ }
+
--- /dev/null
+From d9bfbb95ed598a09cf336adb0f190ee0ff802f0d Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Thu, 26 Nov 2015 14:00:47 +0200
+Subject: mmc: sdio: Fix invalid vdd in voltage switch power cycle
+
+From: Adrian Hunter <adrian.hunter@intel.com>
+
+commit d9bfbb95ed598a09cf336adb0f190ee0ff802f0d upstream.
+
+The 'ocr' parameter passed to mmc_set_signal_voltage()
+defines the power-on voltage used when power cycling
+after a failure to set the voltage. However, in the
+case of mmc_sdio_init_card(), the value passed has the
+R4_18V_PRESENT flag set which is not valid for power-on
+and results in an invalid vdd. Fix by passing the card's
+ocr value which does not have the flag.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/core/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -630,7 +630,7 @@ try_again:
+ */
+ if (!powered_resume && (rocr & ocr & R4_18V_PRESENT)) {
+ err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_180,
+- ocr);
++ ocr_card);
+ if (err == -EAGAIN) {
+ sdio_reset(host);
+ mmc_go_idle(host);
--- /dev/null
+From 05caee939f8d58d81e962071da85761e1e3a4c73 Mon Sep 17 00:00:00 2001
+From: Rabin Vincent <rabin.vincent@axis.com>
+Date: Fri, 27 Nov 2015 12:59:11 +0100
+Subject: mmc: usdhi6rol0: handle NULL data in timeout
+
+From: Rabin Vincent <rabin.vincent@axis.com>
+
+commit 05caee939f8d58d81e962071da85761e1e3a4c73 upstream.
+
+Commit bb08a7d489bd ("mmc: usdhi6rol0: fix NULL pointer deref in debug
+print") fixed one NULL pointer dereference but unfortunately introduced
+another. "data" may be NULL if this is a command timeout for a command
+without any data, so we should only use it if we're actually waiting for
+data.
+
+Fixes: bb08a7d489bd ("mmc: usdhi6rol0: fix NULL pointer deref in debug print")
+Signed-off-by: Rabin Vincent <rabin.vincent@axis.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/usdhi6rol0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/usdhi6rol0.c
++++ b/drivers/mmc/host/usdhi6rol0.c
+@@ -1634,7 +1634,7 @@ static void usdhi6_timeout_work(struct w
+ struct usdhi6_host *host = container_of(d, struct usdhi6_host, timeout_work);
+ struct mmc_request *mrq = host->mrq;
+ struct mmc_data *data = mrq ? mrq->data : NULL;
+- struct scatterlist *sg = host->sg ?: data->sg;
++ struct scatterlist *sg;
+
+ dev_warn(mmc_dev(host->mmc),
+ "%s timeout wait %u CMD%d: IRQ 0x%08x:0x%08x, last IRQ 0x%08x\n",
+@@ -1666,6 +1666,7 @@ static void usdhi6_timeout_work(struct w
+ case USDHI6_WAIT_FOR_MWRITE:
+ case USDHI6_WAIT_FOR_READ:
+ case USDHI6_WAIT_FOR_WRITE:
++ sg = host->sg ?: data->sg;
+ dev_dbg(mmc_dev(host->mmc),
+ "%c: page #%u @ +0x%zx %ux%u in SG%u. Current SG %u bytes @ %u\n",
+ data->flags & MMC_DATA_READ ? 'R' : 'W', host->page_idx,
--- /dev/null
+From 1b9f23727abb92c5e58f139e7d180befcaa06fe0 Mon Sep 17 00:00:00 2001
+From: Richard Cochran <richardcochran@gmail.com>
+Date: Tue, 22 Dec 2015 22:19:58 +0100
+Subject: posix-clock: Fix return code on the poll method's error path
+
+From: Richard Cochran <richardcochran@gmail.com>
+
+commit 1b9f23727abb92c5e58f139e7d180befcaa06fe0 upstream.
+
+The posix_clock_poll function is supposed to return a bit mask of
+POLLxxx values. However, in case the hardware has disappeared (due to
+hot plugging for example) this code returns -ENODEV in a futile
+attempt to throw an error at the file descriptor level. The kernel's
+file_operations interface does not accept such error codes from the
+poll method. Instead, this function aught to return POLLERR.
+
+The value -ENODEV does, in fact, contain the POLLERR bit (and almost
+all the other POLLxxx bits as well), but only by chance. This patch
+fixes code to return a proper bit mask.
+
+Credit goes to Markus Elfring for pointing out the suspicious
+signed/unsigned mismatch.
+
+Reported-by: Markus Elfring <elfring@users.sourceforge.net>
+igned-off-by: Richard Cochran <richardcochran@gmail.com>
+Cc: John Stultz <john.stultz@linaro.org>
+Cc: Julia Lawall <julia.lawall@lip6.fr>
+Link: http://lkml.kernel.org/r/1450819198-17420-1-git-send-email-richardcochran@gmail.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/posix-clock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/time/posix-clock.c
++++ b/kernel/time/posix-clock.c
+@@ -69,10 +69,10 @@ static ssize_t posix_clock_read(struct f
+ static unsigned int posix_clock_poll(struct file *fp, poll_table *wait)
+ {
+ struct posix_clock *clk = get_posix_clock(fp);
+- int result = 0;
++ unsigned int result = 0;
+
+ if (!clk)
+- return -ENODEV;
++ return POLLERR;
+
+ if (clk->ops.poll)
+ result = clk->ops.poll(clk, fp, wait);
--- /dev/null
+From 3cb99e2ea99a454c8837a55aac88753ef05fc1eb Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Tue, 22 Dec 2015 17:08:06 +0800
+Subject: regulator: axp20x: Fix GPIO LDO enable value for AXP22x
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 3cb99e2ea99a454c8837a55aac88753ef05fc1eb upstream.
+
+The enable/disable values for GPIO LDOs are reversed. It seems no one
+noticed as AXP22x support was introduced recently, and no one was using
+the GPIO LDOs, either because no designs actually use them or board
+support hasn't caught up.
+
+Fixes: 1b82b4e4f954 ("regulator: axp20x: Add support for AXP22X regulators")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/axp20x-regulator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/regulator/axp20x-regulator.c
++++ b/drivers/regulator/axp20x-regulator.c
+@@ -27,8 +27,8 @@
+ #define AXP20X_IO_ENABLED 0x03
+ #define AXP20X_IO_DISABLED 0x07
+
+-#define AXP22X_IO_ENABLED 0x04
+-#define AXP22X_IO_DISABLED 0x03
++#define AXP22X_IO_ENABLED 0x03
++#define AXP22X_IO_DISABLED 0x04
+
+ #define AXP20X_WORKMODE_DCDC2_MASK BIT(2)
+ #define AXP20X_WORKMODE_DCDC3_MASK BIT(1)
--- /dev/null
+From aab3c3f34cc2dd8230052770712606d65de6538f Mon Sep 17 00:00:00 2001
+From: Henry Chen <henryc.chen@mediatek.com>
+Date: Tue, 17 Nov 2015 16:36:49 +0800
+Subject: regulator: mt6311: MT6311_REGULATOR needs to select REGMAP_I2C
+
+From: Henry Chen <henryc.chen@mediatek.com>
+
+commit aab3c3f34cc2dd8230052770712606d65de6538f upstream.
+
+This patch fix the below build error:
+drivers/regulator/mt6311-regulator.c:111: undefined reference to `__devm_regmap_init_i2c'
+
+Signed-off-by: Henry Chen <henryc.chen@mediatek.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/regulator/Kconfig
++++ b/drivers/regulator/Kconfig
+@@ -446,6 +446,7 @@ config REGULATOR_MC13892
+ config REGULATOR_MT6311
+ tristate "MediaTek MT6311 PMIC"
+ depends on I2C
++ select REGMAP_I2C
+ help
+ Say y here to select this option to enable the power regulator of
+ MediaTek MT6311 PMIC.
--- /dev/null
+From 800dc4f49cc002879e1e5e6b79926f86b60528e6 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Fri, 22 Jan 2016 09:20:37 -0800
+Subject: Revert "MIPS: Fix PAGE_MASK definition"
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 800dc4f49cc002879e1e5e6b79926f86b60528e6 upstream.
+
+This reverts commit 22b14523994588279ae9c5ccfe64073c1e5b3c00.
+
+It was originally sent in an earlier revision of the pfn_t patchset.
+Besides being broken, the warning is also fixed by PFN_FLAGS_MASK
+casting the PAGE_MASK to an unsigned long.
+
+Reported-by: Manuel Lauss <manuel.lauss@gmail.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Cc: linux-kernel@vger.kernel.org
+Cc: Linux-MIPS <linux-mips@linux-mips.org>
+Patchwork: https://patchwork.linux-mips.org/patch/12182/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/page.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/include/asm/page.h
++++ b/arch/mips/include/asm/page.h
+@@ -33,7 +33,7 @@
+ #define PAGE_SHIFT 16
+ #endif
+ #define PAGE_SIZE (_AC(1,UL) << PAGE_SHIFT)
+-#define PAGE_MASK (~(PAGE_SIZE - 1))
++#define PAGE_MASK (~((1 << PAGE_SHIFT) - 1))
+
+ /*
+ * This is used for calculating the real page sizes
dm-snapshot-fix-hung-bios-when-copy-error-occurs.patch
dm-fix-dm_rq_target_io-leak-on-faults-with-.request_fn-dm-w-blk-mq-paths.patch
coresight-checking-for-null-string-in-coresight_name_match.patch
+irqchip-omap-intc-add-support-for-spurious-irq-handling.patch
+irqchip-mxs-add-missing-set_handle_irq.patch
+irqchip-atmel-aic-fix-wrong-bit-operation-for-irq-priority.patch
+irqchip-gic-v3-its-fix-double-icc_eoir-write-for-lpi-in-eoimode-1.patch
+posix-clock-fix-return-code-on-the-poll-method-s-error-path.patch
+clockevents-tcb_clksrc-prevent-disabling-an-already-disabled-clock.patch
+mmc-usdhi6rol0-handle-null-data-in-timeout.patch
+mmc-sdhci-pci-do-not-default-to-33-ohm-driver-strength-for-intel-spt.patch
+mmc-sdhci-fix-dma-descriptor-with-zero-data-length.patch
+mmc-sdio-fix-invalid-vdd-in-voltage-switch-power-cycle.patch
+mmc-mmc-fix-incorrect-use-of-driver-strength-switching-hs200-and-hs400.patch
+mmc-sdhci-fix-sdhci_runtime_pm_bus_on-off.patch
+mmc-core-enable-tuning-according-to-the-actual-timing.patch
+mmc-mmci-fix-an-ages-old-detection-error.patch
+mmc-sdhci-acpi-fix-card-detect-race-for-intel-bxt-apl.patch
+mmc-pxamci-fix-again-read-only-gpio-detection-polarity.patch
+mmc-sdhci-pci-fix-card-detect-race-for-intel-bxt-apl.patch
+mmc-sdhci-allow-override-of-mmc-host-operations.patch
+mmc-sdhci-allow-override-of-get_cd-called-from-sdhci_request.patch
+tools-hv-vss-fix-the-write-s-argument-error-vss_msg.patch
+drivers-hv-vmbus-fix-a-host-signaling-bug.patch
+bluetooth-use-continuous-scanning-when-creating-le-connections.patch
+bluetooth-add-support-of-toshiba-broadcom-based-devices.patch
+bluetooth-fix-incorrect-removing-of-irks.patch
+bluetooth-6lowpan-fix-kernel-null-pointer-dereferences.patch
+bluetooth-6lowpan-fix-handling-of-uncompressed-ipv6-packets.patch
+time-avoid-signed-overflow-in-timekeeping_get_ns.patch
+cputime-prevent-32bit-overflow-in-time_to_cputime.patch
+revert-mips-fix-page_mask-definition.patch
+mips-loongson-3-fix-smp_ask_c0count-ipi-handler.patch
+mips-hpet-choose-a-safe-value-for-the-etime-check.patch
+mips-fix-some-missing-config_cpu_mipsr6-ifdefs.patch
+mips-fix-buffer-overflow-in-syscall_get_arguments.patch
+edac-robustify-workqueues-destruction.patch
+edac-mc_sysfs-fix-freeing-bus-name.patch
+sparc64-fix-incorrect-sign-extension-in-sys_sparc64_personality.patch
+cxl-use-correct-operator-when-writing-pcie-config-space-values.patch
+clk-exynos-use-irqsave-version-of-spin_lock-to-avoid-deadlock-with-irqs.patch
+regulator-axp20x-fix-gpio-ldo-enable-value-for-axp22x.patch
+regulator-mt6311-mt6311_regulator-needs-to-select-regmap_i2c.patch
--- /dev/null
+From 525fd5a94e1be0776fa652df5c687697db508c91 Mon Sep 17 00:00:00 2001
+From: "Dmitry V. Levin" <ldv@altlinux.org>
+Date: Sun, 27 Dec 2015 02:13:27 +0300
+Subject: sparc64: fix incorrect sign extension in sys_sparc64_personality
+
+From: Dmitry V. Levin <ldv@altlinux.org>
+
+commit 525fd5a94e1be0776fa652df5c687697db508c91 upstream.
+
+The value returned by sys_personality has type "long int".
+It is saved to a variable of type "int", which is not a problem
+yet because the type of task_struct->pesonality is "unsigned int".
+The problem is the sign extension from "int" to "long int"
+that happens on return from sys_sparc64_personality.
+
+For example, a userspace call personality((unsigned) -EINVAL) will
+result to any subsequent personality call, including absolutely
+harmless read-only personality(0xffffffff) call, failing with
+errno set to EINVAL.
+
+Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sparc/kernel/sys_sparc_64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -413,7 +413,7 @@ out:
+
+ SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
+ {
+- int ret;
++ long ret;
+
+ if (personality(current->personality) == PER_LINUX32 &&
+ personality(personality) == PER_LINUX)
--- /dev/null
+From 35a4933a895927990772ae96fdcfd2f806929ee2 Mon Sep 17 00:00:00 2001
+From: David Gibson <david@gibson.dropbear.id.au>
+Date: Mon, 30 Nov 2015 12:30:30 +1100
+Subject: time: Avoid signed overflow in timekeeping_get_ns()
+
+From: David Gibson <david@gibson.dropbear.id.au>
+
+commit 35a4933a895927990772ae96fdcfd2f806929ee2 upstream.
+
+1e75fa8 "time: Condense timekeeper.xtime into xtime_sec" replaced a call to
+clocksource_cyc2ns() from timekeeping_get_ns() with an open-coded version
+of the same logic to avoid keeping a semi-redundant struct timespec
+in struct timekeeper.
+
+However, the commit also introduced a subtle semantic change - where
+clocksource_cyc2ns() uses purely unsigned math, the new version introduces
+a signed temporary, meaning that if (delta * tk->mult) has a 63-bit
+overflow the following shift will still give a negative result. The
+choice of 'maxsec' in __clocksource_updatefreq_scale() means this will
+generally happen if there's a ~10 minute pause in examining the
+clocksource.
+
+This can be triggered on a powerpc KVM guest by stopping it from qemu for
+a bit over 10 minutes. After resuming time has jumped backwards several
+minutes causing numerous problems (jiffies does not advance, msleep()s can
+be extended by minutes..). It doesn't happen on x86 KVM guests, because
+the guest TSC is effectively frozen while the guest is stopped, which is
+not the case for the powerpc timebase.
+
+Obviously an unsigned (64 bit) overflow will only take twice as long as a
+signed, 63-bit overflow. I don't know the time code well enough to know
+if that will still cause incorrect calculations, or if a 64-bit overflow
+is avoided elsewhere.
+
+Still, an incorrect forwards clock adjustment will cause less trouble than
+time going backwards. So, this patch removes the potential for
+intermediate signed overflow.
+
+Suggested-by: Laurent Vivier <lvivier@redhat.com>
+Tested-by: Laurent Vivier <lvivier@redhat.com>
+Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/time/timekeeping.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -305,8 +305,7 @@ static inline s64 timekeeping_get_ns(str
+
+ delta = timekeeping_get_delta(tkr);
+
+- nsec = delta * tkr->mult + tkr->xtime_nsec;
+- nsec >>= tkr->shift;
++ nsec = (delta * tkr->mult + tkr->xtime_nsec) >> tkr->shift;
+
+ /* If arch requires, add in get_arch_timeoffset() */
+ return nsec + arch_gettimeoffset();
--- /dev/null
+From a689d2510f188e75391dbebacbddfd74d42f2a7e Mon Sep 17 00:00:00 2001
+From: Dexuan Cui <decui@microsoft.com>
+Date: Mon, 14 Dec 2015 16:01:58 -0800
+Subject: tools: hv: vss: fix the write()'s argument: error -> vss_msg
+
+From: Dexuan Cui <decui@microsoft.com>
+
+commit a689d2510f188e75391dbebacbddfd74d42f2a7e upstream.
+
+Fix the write()'s argument in the daemon code.
+
+Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
+Cc: "K. Y. Srinivasan" <kys@microsoft.com>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/hv/hv_vss_daemon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/hv/hv_vss_daemon.c
++++ b/tools/hv/hv_vss_daemon.c
+@@ -254,7 +254,7 @@ int main(int argc, char *argv[])
+ syslog(LOG_ERR, "Illegal op:%d\n", op);
+ }
+ vss_msg->error = error;
+- len = write(vss_fd, &error, sizeof(struct hv_vss_msg));
++ len = write(vss_fd, vss_msg, sizeof(struct hv_vss_msg));
+ if (len != sizeof(struct hv_vss_msg)) {
+ syslog(LOG_ERR, "write failed; error: %d %s", errno,
+ strerror(errno));
projects / thirdparty / kernel / stable-queue.git / commitdiff
