--- /dev/null
+From 362f4562466c3b9490e733e06999025638310d4a Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Thu, 19 Jan 2017 08:49:08 -0800
+Subject: dmaengine: cppi41: Fix oops in cppi41_runtime_resume
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 362f4562466c3b9490e733e06999025638310d4a upstream.
+
+Commit fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support")
+together with recent MUSB changes allowed USB and DMA on BeagleBone to idle
+when no cable is connected. But looks like few corner case issues still
+remain.
+
+Looks like just by re-plugging USB cable about ten or so times on BeagleBone
+when configured in USB peripheral mode we can get warnings and eventually
+trigger an oops in cppi41 DMA:
+
+WARNING: CPU: 0 PID: 14 at drivers/dma/cppi41.c:1154 cppi41_runtime_suspend+
+x28/0x38 [cppi41]
+...
+
+WARNING: CPU: 0 PID: 14 at drivers/dma/cppi41.c:452
+push_desc_queue+0x94/0x9c [cppi41]
+...
+
+Unable to handle kernel NULL pointer dereference at virtual
+address 00000104
+pgd = c0004000
+[00000104] *pgd=00000000
+Internal error: Oops: 805 [#1] SMP ARM
+...
+[<bf0d92cc>] (cppi41_runtime_resume [cppi41]) from [<c0589838>]
+(__rpm_callback+0xc0/0x214)
+[<c0589838>] (__rpm_callback) from [<c05899ac>] (rpm_callback+0x20/0x80)
+[<c05899ac>] (rpm_callback) from [<c0589460>] (rpm_resume+0x504/0x78c)
+[<c0589460>] (rpm_resume) from [<c058a1a0>] (pm_runtime_work+0x60/0xa8)
+[<c058a1a0>] (pm_runtime_work) from [<c0156120>] (process_one_work+0x2b4/0x808)
+
+This is because of a race with runtime PM and cppi41_dma_issue_pending()
+as reported by Alexandre Bailon <abailon@baylibre.com> in earlier
+set of patches. Based on mailing list discussions we however came to the
+conclusion that a different fix from Alexandre's fix is needed in order
+to guarantee that DMA is really active when we try to use it.
+
+To fix the issue, we need to add a driver specific flag as we otherwise
+can have -EINPROGRESS state set by runtime PM and can't rely on
+pm_runtime_active() to tell us when we can use the DMA.
+
+And we need to make sure the DMA transfers get triggered in the queued
+order. So let's always queue the transfers, then flush the queue
+from both cppi41_dma_issue_pending() and cppi41_runtime_resume()
+as suggested by Grygorii Strashko <grygorii.strashko@ti.com> in an
+earlier example patch.
+
+For reference, this is also documented in Documentation/power/runtime_pm.txt
+in the example at the end of the file as pointed out by Grygorii Strashko
+<grygorii.strashko@ti.com>.
+
+Based on earlier patches from Alexandre Bailon <abailon@baylibre.com>
+and Grygorii Strashko <grygorii.strashko@ti.com> modified based on
+testing and what was discussed on the mailing lists.
+
+Fixes: fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support")
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Bin Liu <b-liu@ti.com>
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: Kevin Hilman <khilman@baylibre.com>
+Cc: Patrick Titiano <ptitiano@baylibre.com>
+Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Reported-by: Alexandre Bailon <abailon@baylibre.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/cppi41.c | 40 +++++++++++++++++++++++++---------------
+ 1 file changed, 25 insertions(+), 15 deletions(-)
+
+--- a/drivers/dma/cppi41.c
++++ b/drivers/dma/cppi41.c
+@@ -153,6 +153,8 @@ struct cppi41_dd {
+
+ /* context for suspend/resume */
+ unsigned int dma_tdfdq;
++
++ bool is_suspended;
+ };
+
+ #define FIST_COMPLETION_QUEUE 93
+@@ -470,20 +472,26 @@ static void push_desc_queue(struct cppi4
+ cppi_writel(reg, cdd->qmgr_mem + QMGR_QUEUE_D(c->q_num));
+ }
+
+-static void pending_desc(struct cppi41_channel *c)
++/*
++ * Caller must hold cdd->lock to prevent push_desc_queue()
++ * getting called out of order. We have both cppi41_dma_issue_pending()
++ * and cppi41_runtime_resume() call this function.
++ */
++static void cppi41_run_queue(struct cppi41_dd *cdd)
+ {
+- struct cppi41_dd *cdd = c->cdd;
+- unsigned long flags;
++ struct cppi41_channel *c, *_c;
+
+- spin_lock_irqsave(&cdd->lock, flags);
+- list_add_tail(&c->node, &cdd->pending);
+- spin_unlock_irqrestore(&cdd->lock, flags);
++ list_for_each_entry_safe(c, _c, &cdd->pending, node) {
++ push_desc_queue(c);
++ list_del(&c->node);
++ }
+ }
+
+ static void cppi41_dma_issue_pending(struct dma_chan *chan)
+ {
+ struct cppi41_channel *c = to_cpp41_chan(chan);
+ struct cppi41_dd *cdd = c->cdd;
++ unsigned long flags;
+ int error;
+
+ error = pm_runtime_get(cdd->ddev.dev);
+@@ -495,10 +503,11 @@ static void cppi41_dma_issue_pending(str
+ return;
+ }
+
+- if (likely(pm_runtime_active(cdd->ddev.dev)))
+- push_desc_queue(c);
+- else
+- pending_desc(c);
++ spin_lock_irqsave(&cdd->lock, flags);
++ list_add_tail(&c->node, &cdd->pending);
++ if (!cdd->is_suspended)
++ cppi41_run_queue(cdd);
++ spin_unlock_irqrestore(&cdd->lock, flags);
+
+ pm_runtime_mark_last_busy(cdd->ddev.dev);
+ pm_runtime_put_autosuspend(cdd->ddev.dev);
+@@ -1166,8 +1175,12 @@ static int __maybe_unused cppi41_resume(
+ static int __maybe_unused cppi41_runtime_suspend(struct device *dev)
+ {
+ struct cppi41_dd *cdd = dev_get_drvdata(dev);
++ unsigned long flags;
+
++ spin_lock_irqsave(&cdd->lock, flags);
++ cdd->is_suspended = true;
+ WARN_ON(!list_empty(&cdd->pending));
++ spin_unlock_irqrestore(&cdd->lock, flags);
+
+ return 0;
+ }
+@@ -1175,14 +1188,11 @@ static int __maybe_unused cppi41_runtime
+ static int __maybe_unused cppi41_runtime_resume(struct device *dev)
+ {
+ struct cppi41_dd *cdd = dev_get_drvdata(dev);
+- struct cppi41_channel *c, *_c;
+ unsigned long flags;
+
+ spin_lock_irqsave(&cdd->lock, flags);
+- list_for_each_entry_safe(c, _c, &cdd->pending, node) {
+- push_desc_queue(c);
+- list_del(&c->node);
+- }
++ cdd->is_suspended = false;
++ cppi41_run_queue(cdd);
+ spin_unlock_irqrestore(&cdd->lock, flags);
+
+ return 0;
--- /dev/null
+From ae4a3e028bb8b59e7cfeb0cc9ef03d885182ce8b Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Thu, 19 Jan 2017 08:49:07 -0800
+Subject: dmaengine: cppi41: Fix runtime PM timeouts with USB mass storage
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit ae4a3e028bb8b59e7cfeb0cc9ef03d885182ce8b upstream.
+
+Commit fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support")
+added runtime PM support for cppi41, but had corner case issues. Some of
+the issues were fixed with commit 098de42ad670 ("dmaengine: cppi41: Fix
+unpaired pm runtime when only a USB hub is connected"). That fix however
+caused a new regression where we can get error -115 messages with USB on
+BeagleBone when connecting a USB mass storage device to a hub.
+
+This is because when connecting a USB mass storage device to a hub, the
+initial DMA transfers can take over 200ms to complete and cppi41
+autosuspend delay times out.
+
+To fix the issue, we want to implement refcounting for chan_busy array
+that contains the active dma transfers. Increasing the autosuspend delay
+won't help as that the delay could be potentially seconds, and it's best
+to let the USB subsystem to deal with the timeouts on errors.
+
+The earlier attempt for runtime PM was buggy as the pm_runtime_get/put()
+calls could get unpaired easily as they did not follow the state of
+the chan_busy array as described in commit 098de42ad670 ("dmaengine:
+cppi41: Fix unpaired pm runtime when only a USB hub is connected".
+
+Let's fix the issue by adding pm_runtime_get() to where a new transfer
+is added to the chan_busy array, and calls to pm_runtime_put() where
+chan_busy array entry is cleared. This prevents any autosuspend timeouts
+from happening while dma transfers are active.
+
+Fixes: 098de42ad670 ("dmaengine: cppi41: Fix unpaired pm runtime when
+only a USB hub is connected")
+Fixes: fdea2d09b997 ("dmaengine: cppi41: Add basic PM runtime support")
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Bin Liu <b-liu@ti.com>
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: Kevin Hilman <khilman@baylibre.com>
+Cc: Patrick Titiano <ptitiano@baylibre.com>
+Cc: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Tested-by: Bin Liu <b-liu@ti.com>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/cppi41.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/dma/cppi41.c
++++ b/drivers/dma/cppi41.c
+@@ -257,6 +257,10 @@ static struct cppi41_channel *desc_to_ch
+ BUG_ON(desc_num >= ALLOC_DECS_NUM);
+ c = cdd->chan_busy[desc_num];
+ cdd->chan_busy[desc_num] = NULL;
++
++ /* Usecount for chan_busy[], paired with push_desc_queue() */
++ pm_runtime_put(cdd->ddev.dev);
++
+ return c;
+ }
+
+@@ -447,6 +451,15 @@ static void push_desc_queue(struct cppi4
+ */
+ __iowmb();
+
++ /*
++ * DMA transfers can take at least 200ms to complete with USB mass
++ * storage connected. To prevent autosuspend timeouts, we must use
++ * pm_runtime_get/put() when chan_busy[] is modified. This will get
++ * cleared in desc_to_chan() or cppi41_stop_chan() depending on the
++ * outcome of the transfer.
++ */
++ pm_runtime_get(cdd->ddev.dev);
++
+ desc_phys = lower_32_bits(c->desc_phys);
+ desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc);
+ WARN_ON(cdd->chan_busy[desc_num]);
+@@ -705,6 +718,9 @@ static int cppi41_stop_chan(struct dma_c
+ WARN_ON(!cdd->chan_busy[desc_num]);
+ cdd->chan_busy[desc_num] = NULL;
+
++ /* Usecount for chan_busy[], paired with push_desc_queue() */
++ pm_runtime_put(cdd->ddev.dev);
++
+ return 0;
+ }
+
--- /dev/null
+From 877a021e08ccb6434718c0cc781fdf943c884cc0 Mon Sep 17 00:00:00 2001
+From: Ardinartsev Nikita <pinguin255@gmail.com>
+Date: Thu, 26 Jan 2017 16:54:42 +0300
+Subject: HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2
+
+From: Ardinartsev Nikita <pinguin255@gmail.com>
+
+commit 877a021e08ccb6434718c0cc781fdf943c884cc0 upstream.
+
+With NOGET quirk Logitech F510 is now fully workable in dinput mode including
+rumble effects (according to fftest).
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=117091
+
+[jkosina@suse.cz: fix patch format]
+Signed-off-by: Ardinartsev Nikita <ardinar23@gmail.com>
+Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-lg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -872,7 +872,7 @@ static const struct hid_device_id lg_dev
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG),
+ .driver_data = LG_NOGET | LG_FF4 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
+- .driver_data = LG_FF2 },
++ .driver_data = LG_NOGET | LG_FF2 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940),
+ .driver_data = LG_FF3 },
+ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR),
--- /dev/null
+From ed9ab4287f96e66340e0390e2c583f2f9110cba0 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 26 Jan 2017 17:34:40 +0000
+Subject: HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit ed9ab4287f96e66340e0390e2c583f2f9110cba0 upstream.
+
+Quirking the following AMI USB device with ALWAYS_POLL fixes an AMI
+virtual keyboard and mouse from not responding and timing out when
+it is attached to a ppc64el Power 8 system and when we have some
+rapid open/closes on the mouse device.
+
+ usb 1-3: new high-speed USB device number 2 using xhci_hcd
+ usb 1-3: New USB device found, idVendor=046b, idProduct=ff01
+ usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+ usb 1-3: Product: Virtual Hub
+ usb 1-3: Manufacturer: American Megatrends Inc.
+ usb 1-3: SerialNumber: serial
+ usb 1-3.3: new high-speed USB device number 3 using xhci_hcd
+ usb 1-3.3: New USB device found, idVendor=046b, idProduct=ff31
+ usb 1-3.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
+ usb 1-3.3: Product: Virtual HardDisk Device
+ usb 1-3.3: Manufacturer: American Megatrends Inc.
+ usb 1-3.4: new low-speed USB device number 4 using xhci_hcd
+ usb 1-3.4: New USB device found, idVendor=046b, idProduct=ff10
+ usb 1-3.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
+ usb 1-3.4: Product: Virtual Keyboard and Mouse
+ usb 1-3.4: Manufacturer: American Megatrends Inc.
+
+With the quirk I have not been able to trigger the issue with
+half an hour of saturation soak testing.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/hid-ids.h | 3 +++
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -76,6 +76,9 @@
+ #define USB_VENDOR_ID_ALPS_JP 0x044E
+ #define HID_DEVICE_ID_ALPS_U1_DUAL 0x120B
+
++#define USB_VENDOR_ID_AMI 0x046b
++#define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10
++
+ #define USB_VENDOR_ID_ANTON 0x1130
+ #define USB_DEVICE_ID_ANTON_TOUCH_PAD 0x3101
+
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -57,6 +57,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
++ { USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
--- /dev/null
+From 282e4637bc1c0b338708bcebd09d31c69abec070 Mon Sep 17 00:00:00 2001
+From: Jason Gerecke <killertofu@gmail.com>
+Date: Thu, 26 Jan 2017 09:06:22 -0800
+Subject: HID: wacom: Fix poor prox handling in 'wacom_pl_irq'
+
+From: Jason Gerecke <killertofu@gmail.com>
+
+commit 282e4637bc1c0b338708bcebd09d31c69abec070 upstream.
+
+Commit 025bcc1 performed cleanup work on the 'wacom_pl_irq' function, making
+it follow the standards used in the rest of the codebase. The change
+unintiontionally allowed the function to send input events from reports
+that are not marked as being in prox. This can cause problems as the
+report values for X, Y, etc. are not guaranteed to be correct. In
+particular, occasionally the tablet will send a report with these values
+set to zero. If such a report is received it can caus an unexpected jump
+in the XY position.
+
+This patch surrounds more of the processing code with a proximity check,
+preventing these zeroed reports from overwriting the current state. To
+be safe, only the tool type and ABS_MISC events should be reported when
+the pen is marked as being out of prox.
+
+Fixes: 025bcc1540 ("HID: wacom: Simplify 'wacom_pl_irq'")
+Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
+Reviewed-by: Ping Cheng <pingc@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/wacom_wac.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -164,19 +164,21 @@ static int wacom_pl_irq(struct wacom_wac
+ wacom->id[0] = STYLUS_DEVICE_ID;
+ }
+
+- pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
+- if (features->pressure_max > 255)
+- pressure = (pressure << 1) | ((data[4] >> 6) & 1);
+- pressure += (features->pressure_max + 1) / 2;
++ if (prox) {
++ pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1));
++ if (features->pressure_max > 255)
++ pressure = (pressure << 1) | ((data[4] >> 6) & 1);
++ pressure += (features->pressure_max + 1) / 2;
+
+- input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
+- input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
+- input_report_abs(input, ABS_PRESSURE, pressure);
++ input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14));
++ input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14));
++ input_report_abs(input, ABS_PRESSURE, pressure);
+
+- input_report_key(input, BTN_TOUCH, data[4] & 0x08);
+- input_report_key(input, BTN_STYLUS, data[4] & 0x10);
+- /* Only allow the stylus2 button to be reported for the pen tool. */
+- input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
++ input_report_key(input, BTN_TOUCH, data[4] & 0x08);
++ input_report_key(input, BTN_STYLUS, data[4] & 0x10);
++ /* Only allow the stylus2 button to be reported for the pen tool. */
++ input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20));
++ }
+
+ if (!prox)
+ wacom->id[0] = 0;
--- /dev/null
+From 7941c59e45f3b6d30e07375e9b6713427e0a9f98 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=BCrg=20Billeter?= <j@bitron.ch>
+Date: Mon, 10 Oct 2016 18:30:01 +0200
+Subject: iwlwifi: fix double hyphen in MODULE_FIRMWARE for 8000
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jürg Billeter <j@bitron.ch>
+
+commit 7941c59e45f3b6d30e07375e9b6713427e0a9f98 upstream.
+
+Mistakenly, the driver is trying to load the 8000C firmware with an
+incorrect name (i.e. with two hyphens where there should be only one)
+and that fails. Fix that by removing the hyphen from the format
+macro.
+
+Fixes: e1ba684f762b ("iwlwifi: 8000: fix MODULE_FIRMWARE input")
+Signed-off-by: Jürg Billeter <j@bitron.ch>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-8000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-8000.c
+@@ -91,7 +91,7 @@
+
+ #define IWL8000_FW_PRE "iwlwifi-8000C-"
+ #define IWL8000_MODULE_FIRMWARE(api) \
+- IWL8000_FW_PRE "-" __stringify(api) ".ucode"
++ IWL8000_FW_PRE __stringify(api) ".ucode"
+
+ #define IWL8265_FW_PRE "iwlwifi-8265-"
+ #define IWL8265_MODULE_FIRMWARE(api) \
--- /dev/null
+From 03c902bff524e0cf664737a33f2365f7837040bf Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 2 Dec 2016 12:03:36 +0100
+Subject: iwlwifi: mvm: avoid crash on restart w/o reserved queues
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 03c902bff524e0cf664737a33f2365f7837040bf upstream.
+
+When the firmware restarts in a situation in which any station
+has no queue reserved anymore because that queue was used, the
+code will crash trying to access the queue_info array at the
+offset 255, which is far too big. Fix this by checking that a
+queue is actually reserved before writing its status.
+
+Fixes: 8d98ae6eb0d5 ("iwlwifi: mvm: re-assign old queues after hw restart in dqa mode")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -1144,9 +1144,10 @@ static void iwl_mvm_realloc_queues_after
+ .frame_limit = IWL_FRAME_LIMIT,
+ };
+
+- /* Make sure reserved queue is still marked as such (or allocated) */
+- mvm->queue_info[mvm_sta->reserved_queue].status =
+- IWL_MVM_QUEUE_RESERVED;
++ /* Make sure reserved queue is still marked as such (if allocated) */
++ if (mvm_sta->reserved_queue != IEEE80211_INVAL_HW_QUEUE)
++ mvm->queue_info[mvm_sta->reserved_queue].status =
++ IWL_MVM_QUEUE_RESERVED;
+
+ for (i = 0; i <= IWL_MAX_TID_COUNT; i++) {
+ struct iwl_mvm_tid_data *tid_data = &mvm_sta->tid_data[i];
--- /dev/null
+From 1aa6cfd33df492939b0be15ebdbcff1f8ae5ddb6 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Tue, 31 Jan 2017 23:58:39 +0100
+Subject: perf/x86/intel/uncore: Clean up hotplug conversion fallout
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 1aa6cfd33df492939b0be15ebdbcff1f8ae5ddb6 upstream.
+
+The recent conversion to the hotplug state machine kept two mechanisms from
+the original code:
+
+ 1) The first_init logic which adds the number of online CPUs in a package
+ to the refcount. That's wrong because the callbacks are executed for
+ all online CPUs.
+
+ Remove it so the refcounting is correct.
+
+ 2) The on_each_cpu() call to undo box->init() in the error handling
+ path. That's bogus because when the prepare callback fails no box has
+ been initialized yet.
+
+ Remove it.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Sebastian Siewior <bigeasy@linutronix.de>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: Yasuaki Ishimatsu <yasu.isimatu@gmail.com>
+Fixes: 1a246b9f58c6 ("perf/x86/intel/uncore: Convert to hotplug state machine")
+Link: http://lkml.kernel.org/r/20170131230141.298032324@linutronix.de
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/events/intel/uncore.c | 44 +++--------------------------------------
+ 1 file changed, 4 insertions(+), 40 deletions(-)
+
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -763,30 +763,6 @@ static void uncore_pmu_unregister(struct
+ pmu->registered = false;
+ }
+
+-static void __uncore_exit_boxes(struct intel_uncore_type *type, int cpu)
+-{
+- struct intel_uncore_pmu *pmu = type->pmus;
+- struct intel_uncore_box *box;
+- int i, pkg;
+-
+- if (pmu) {
+- pkg = topology_physical_package_id(cpu);
+- for (i = 0; i < type->num_boxes; i++, pmu++) {
+- box = pmu->boxes[pkg];
+- if (box)
+- uncore_box_exit(box);
+- }
+- }
+-}
+-
+-static void uncore_exit_boxes(void *dummy)
+-{
+- struct intel_uncore_type **types;
+-
+- for (types = uncore_msr_uncores; *types; types++)
+- __uncore_exit_boxes(*types++, smp_processor_id());
+-}
+-
+ static void uncore_free_boxes(struct intel_uncore_pmu *pmu)
+ {
+ int pkg;
+@@ -1077,22 +1053,12 @@ static int uncore_cpu_dying(unsigned int
+ return 0;
+ }
+
+-static int first_init;
+-
+ static int uncore_cpu_starting(unsigned int cpu)
+ {
+ struct intel_uncore_type *type, **types = uncore_msr_uncores;
+ struct intel_uncore_pmu *pmu;
+ struct intel_uncore_box *box;
+- int i, pkg, ncpus = 1;
+-
+- if (first_init) {
+- /*
+- * On init we get the number of online cpus in the package
+- * and set refcount for all of them.
+- */
+- ncpus = cpumask_weight(topology_core_cpumask(cpu));
+- }
++ int i, pkg;
+
+ pkg = topology_logical_package_id(cpu);
+ for (; *types; types++) {
+@@ -1103,7 +1069,7 @@ static int uncore_cpu_starting(unsigned
+ if (!box)
+ continue;
+ /* The first cpu on a package activates the box */
+- if (atomic_add_return(ncpus, &box->refcnt) == ncpus)
++ if (atomic_inc_return(&box->refcnt) == 1)
+ uncore_box_init(box);
+ }
+ }
+@@ -1407,19 +1373,17 @@ static int __init intel_uncore_init(void
+ "PERF_X86_UNCORE_PREP",
+ uncore_cpu_prepare, NULL);
+ }
+- first_init = 1;
++
+ cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_STARTING,
+ "AP_PERF_X86_UNCORE_STARTING",
+ uncore_cpu_starting, uncore_cpu_dying);
+- first_init = 0;
++
+ cpuhp_setup_state(CPUHP_AP_PERF_X86_UNCORE_ONLINE,
+ "AP_PERF_X86_UNCORE_ONLINE",
+ uncore_event_cpu_online, uncore_event_cpu_offline);
+ return 0;
+
+ err:
+- /* Undo box->init_box() */
+- on_each_cpu_mask(&uncore_cpu_mask, uncore_exit_boxes, NULL, 1);
+ uncore_types_exit(uncore_msr_uncores);
+ uncore_pci_exit();
+ return ret;
--- /dev/null
+From 1b89970d81bbd52720fc64a3fe9572ee33588363 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Thu, 26 Jan 2017 19:24:08 +0200
+Subject: pinctrl: baytrail: Debounce register is one per community
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 1b89970d81bbd52720fc64a3fe9572ee33588363 upstream.
+
+Debounce value is set globally per community. Otherwise user will easily
+get a kernel crash when they start using the feature:
+
+BUG: unable to handle kernel paging request at ffffc900003be000
+IP: byt_gpio_dbg_show+0xa9/0x430
+
+Make it clear in byt_gpio_reg().
+
+Note that this fix just prevents kernel to crash, but doesn't make any
+difference to the existing logic. It means the last caller will win the
+trade and debounce value will be configured accordingly. The actual
+logic fix needs to be thought about and it's not as important as crash
+fix. That's why the latter goes separately and right now.
+
+Fixes: 658b476c742f ("pinctrl: baytrail: Add debounce configuration")
+Cc: Cristina Ciocan <cristina.ciocan@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/intel/pinctrl-baytrail.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -731,16 +731,23 @@ static void __iomem *byt_gpio_reg(struct
+ int reg)
+ {
+ struct byt_community *comm = byt_get_community(vg, offset);
+- u32 reg_offset = 0;
++ u32 reg_offset;
+
+ if (!comm)
+ return NULL;
+
+ offset -= comm->pin_base;
+- if (reg == BYT_INT_STAT_REG)
++ switch (reg) {
++ case BYT_INT_STAT_REG:
+ reg_offset = (offset / 32) * 4;
+- else
++ break;
++ case BYT_DEBOUNCE_REG:
++ reg_offset = 0;
++ break;
++ default:
+ reg_offset = comm->pad_map[offset] * 16;
++ break;
++ }
+
+ return comm->reg_base + reg_offset + reg;
+ }
--- /dev/null
+From 19b26d92dfb70f56440c187a20c49102ab648b97 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 24 Jan 2017 17:28:22 +0200
+Subject: pinctrl: intel: merrifield: Add missed check in mrfld_config_set()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 19b26d92dfb70f56440c187a20c49102ab648b97 upstream.
+
+Not every pin can be configured. Add missed check to prevent access
+violation.
+
+Fixes: 4e80c8f50574 ("pinctrl: intel: Add Intel Merrifield pin controller support")
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/intel/pinctrl-merrifield.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
++++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
+@@ -794,6 +794,9 @@ static int mrfld_config_set(struct pinct
+ unsigned int i;
+ int ret;
+
++ if (!mrfld_buf_available(mp, pin))
++ return -ENOTSUPP;
++
+ for (i = 0; i < nconfigs; i++) {
+ switch (pinconf_to_config_param(configs[i])) {
+ case PIN_CONFIG_BIAS_DISABLE:
percpu-refcount-fix-reference-leak-during-percpu-atomic-transition.patch
revert-bcma-init-serial-console-directly-from-chipcommon-code.patch
revert-vring-force-use-of-dma-api-for-arm-based-systems-with-legacy-devices.patch
+pinctrl-baytrail-debounce-register-is-one-per-community.patch
+pinctrl-intel-merrifield-add-missed-check-in-mrfld_config_set.patch
+iwlwifi-fix-double-hyphen-in-module_firmware-for-8000.patch
+iwlwifi-mvm-avoid-crash-on-restart-w-o-reserved-queues.patch
+hid-usbhid-quirk-a-ami-virtual-mouse-and-keyboard-with-always_poll.patch
+hid-hid-lg-fix-immediate-disconnection-of-logitech-rumblepad-2.patch
+hid-wacom-fix-poor-prox-handling-in-wacom_pl_irq.patch
+perf-x86-intel-uncore-clean-up-hotplug-conversion-fallout.patch
+dmaengine-cppi41-fix-runtime-pm-timeouts-with-usb-mass-storage.patch
+dmaengine-cppi41-fix-oops-in-cppi41_runtime_resume.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
