--- /dev/null
+From a545715d2dae8d071c5b06af947b07ffa846b288 Mon Sep 17 00:00:00 2001
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Wed, 30 Nov 2016 08:19:39 -0500
+Subject: ACPI / APEI: Fix NMI notification handling
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+commit a545715d2dae8d071c5b06af947b07ffa846b288 upstream.
+
+When removing and adding cpu 0 on a system with GHES NMI the following stack
+trace is seen when re-adding the cpu:
+
+WARNING: CPU: 0 PID: 0 at arch/x86/kernel/apic/apic.c:1349 setup_local_APIC+
+Modules linked in: nfsv3 rpcsec_gss_krb5 nfsv4 nfs fscache coretemp intel_ra
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.9.0-rc6+ #2
+Call Trace:
+ dump_stack+0x63/0x8e
+ __warn+0xd1/0xf0
+ warn_slowpath_null+0x1d/0x20
+ setup_local_APIC+0x275/0x370
+ apic_ap_setup+0xe/0x20
+ start_secondary+0x48/0x180
+ set_init_arg+0x55/0x55
+ early_idt_handler_array+0x120/0x120
+ x86_64_start_reservations+0x2a/0x2c
+ x86_64_start_kernel+0x13d/0x14c
+
+During the cpu bringup, wakeup_cpu_via_init_nmi() is called and issues an
+NMI on CPU 0. The GHES NMI handler, ghes_notify_nmi() runs the
+ghes_proc_irq_work work queue which ends up setting IRQ_WORK_VECTOR
+(0xf6). The "faulty" IR line set at arch/x86/kernel/apic/apic.c:1349 is also
+0xf6 (specifically APIC IRR for irqs 255 to 224 is 0x400000) which confirms
+that something has set the IRQ_WORK_VECTOR line prior to the APIC being
+initialized.
+
+Commit 2383844d4850 ("GHES: Elliminate double-loop in the NMI handler")
+incorrectly modified the behavior such that the handler returns
+NMI_HANDLED only if an error was processed, and incorrectly runs the ghes
+work queue for every NMI.
+
+This patch modifies the ghes_proc_irq_work() to run as it did prior to
+2383844d4850 ("GHES: Elliminate double-loop in the NMI handler") by
+properly returning NMI_HANDLED and only calling the work queue if
+NMI_HANDLED has been set.
+
+Fixes: 2383844d4850 (GHES: Elliminate double-loop in the NMI handler)
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/apei/ghes.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -852,6 +852,8 @@ static int ghes_notify_nmi(unsigned int
+ if (ghes_read_estatus(ghes, 1)) {
+ ghes_clear_estatus(ghes);
+ continue;
++ } else {
++ ret = NMI_HANDLED;
+ }
+
+ sev = ghes_severity(ghes->estatus->error_severity);
+@@ -863,12 +865,11 @@ static int ghes_notify_nmi(unsigned int
+
+ __process_error(ghes);
+ ghes_clear_estatus(ghes);
+-
+- ret = NMI_HANDLED;
+ }
+
+ #ifdef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG
+- irq_work_queue(&ghes_proc_irq_work);
++ if (ret == NMI_HANDLED)
++ irq_work_queue(&ghes_proc_irq_work);
+ #endif
+ atomic_dec(&ghes_in_nmi);
+ return ret;
--- /dev/null
+From 501634759d55a5b56967de6d9465acf02bbc3565 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 30 Nov 2016 22:22:54 +0300
+Subject: ACPI / CPPC: set an error code on probe error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 501634759d55a5b56967de6d9465acf02bbc3565 upstream.
+
+We should return -EINVAL (instead of 0) if get_cpu_device() fails.
+
+Fixes: 158c998ea44b (ACPI / CPPC: add sysfs support to compute delivered performance)
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/cppc_acpi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -784,8 +784,10 @@ int acpi_cppc_processor_probe(struct acp
+
+ /* Add per logical CPU nodes for reading its feedback counters. */
+ cpu_dev = get_cpu_device(pr->id);
+- if (!cpu_dev)
++ if (!cpu_dev) {
++ ret = -EINVAL;
+ goto out_free;
++ }
+
+ ret = kobject_init_and_add(&cpc_ptr->kobj, &cppc_ktype, &cpu_dev->kobj,
+ "acpi_cppc");
--- /dev/null
+From c02ebfdddbafa9a6a0f52fbd715e6bfa229af9d3 Mon Sep 17 00:00:00 2001
+From: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+Date: Wed, 28 Sep 2016 00:24:24 -0300
+Subject: blk-mq: Always schedule hctx->next_cpu
+
+From: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+
+commit c02ebfdddbafa9a6a0f52fbd715e6bfa229af9d3 upstream.
+
+Commit 0e87e58bf60e ("blk-mq: improve warning for running a queue on the
+wrong CPU") attempts to avoid triggering the WARN_ON in
+__blk_mq_run_hw_queue when the expected CPU is dead. Problem is, in the
+last batch execution before round robin, blk_mq_hctx_next_cpu can
+schedule a dead CPU and also update next_cpu to the next alive CPU in
+the mask, which will trigger the WARN_ON despite the previous
+workaround.
+
+The following patch fixes this scenario by always scheduling the value
+in hctx->next_cpu. This changes the moment when we round-robin the CPU
+running the hctx, but it really doesn't matter, since it still executes
+BLK_MQ_CPU_WORK_BATCH times in a row before switching to another CPU.
+
+Fixes: 0e87e58bf60e ("blk-mq: improve warning for running a queue on the wrong CPU")
+Signed-off-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-mq.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -895,7 +895,7 @@ static int blk_mq_hctx_next_cpu(struct b
+ return WORK_CPU_UNBOUND;
+
+ if (--hctx->next_cpu_batch <= 0) {
+- int cpu = hctx->next_cpu, next_cpu;
++ int next_cpu;
+
+ next_cpu = cpumask_next(hctx->next_cpu, hctx->cpumask);
+ if (next_cpu >= nr_cpu_ids)
+@@ -903,8 +903,6 @@ static int blk_mq_hctx_next_cpu(struct b
+
+ hctx->next_cpu = next_cpu;
+ hctx->next_cpu_batch = BLK_MQ_CPU_WORK_BATCH;
+-
+- return cpu;
+ }
+
+ return hctx->next_cpu;
--- /dev/null
+From ebc4ff661fbe76781c6b16dfb7b754a5d5073f8e Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Thu, 10 Nov 2016 11:16:37 -0500
+Subject: block: cfq_cpd_alloc() should use @gfp
+
+From: Tejun Heo <tj@kernel.org>
+
+commit ebc4ff661fbe76781c6b16dfb7b754a5d5073f8e upstream.
+
+cfq_cpd_alloc() which is the cpd_alloc_fn implementation for cfq was
+incorrectly hard coding GFP_KERNEL instead of using the mask specified
+through the @gfp parameter. This currently doesn't cause any actual
+issues because all current callers specify GFP_KERNEL. Fix it.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: e4a9bde9589f ("blkcg: replace blkcg_policy->cpd_size with ->cpd_alloc/free_fn() methods")
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/cfq-iosched.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/cfq-iosched.c
++++ b/block/cfq-iosched.c
+@@ -1596,7 +1596,7 @@ static struct blkcg_policy_data *cfq_cpd
+ {
+ struct cfq_group_data *cgd;
+
+- cgd = kzalloc(sizeof(*cgd), GFP_KERNEL);
++ cgd = kzalloc(sizeof(*cgd), gfp);
+ if (!cgd)
+ return NULL;
+ return &cgd->cpd;
--- /dev/null
+From 9a05e7541c39680d28ecf91892338e074738d5fd Mon Sep 17 00:00:00 2001
+From: Tobias Klauser <tklauser@distanz.ch>
+Date: Fri, 18 Nov 2016 15:16:06 +0100
+Subject: block: Change extern inline to static inline
+
+From: Tobias Klauser <tklauser@distanz.ch>
+
+commit 9a05e7541c39680d28ecf91892338e074738d5fd upstream.
+
+With compilers which follow the C99 standard (like modern versions of
+gcc and clang), "extern inline" does the opposite thing from older
+versions of gcc (emits code for an externally linkable version of the
+inline function).
+
+"static inline" does the intended behavior in all cases instead.
+
+Description taken from commit 6d91857d4826 ("staging, rtl8192e,
+LLVMLinux: Change extern inline to static inline").
+
+This also fixes the following GCC warning when building with CONFIG_PM
+disabled:
+
+ ./include/linux/blkdev.h:1143:20: warning: no previous prototype for 'blk_set_runtime_active' [-Wmissing-prototypes]
+
+Fixes: d07ab6d11477 ("block: Add blk_set_runtime_active()")
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/blkdev.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1057,7 +1057,7 @@ static inline int blk_pre_runtime_suspen
+ static inline void blk_post_runtime_suspend(struct request_queue *q, int err) {}
+ static inline void blk_pre_runtime_resume(struct request_queue *q) {}
+ static inline void blk_post_runtime_resume(struct request_queue *q, int err) {}
+-extern inline void blk_set_runtime_active(struct request_queue *q) {}
++static inline void blk_set_runtime_active(struct request_queue *q) {}
+ #endif
+
+ /*
--- /dev/null
+From 075eb5719d53e8bb4a406ad87e1de99319aa50f0 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 14 Nov 2016 19:38:31 -0800
+Subject: bq24190_charger: Fix PM runtime use for bq24190_battery_set_property
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 075eb5719d53e8bb4a406ad87e1de99319aa50f0 upstream.
+
+There's a typo, it should do pm_runtime_get_sync, not put.
+
+Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
+Cc: Mark A. Greer <mgreer@animalcreek.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Reviewed-by: Mark Greer <mgreer@animalcreek.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/supply/bq24190_charger.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/supply/bq24190_charger.c
++++ b/drivers/power/supply/bq24190_charger.c
+@@ -1141,7 +1141,7 @@ static int bq24190_battery_set_property(
+
+ dev_dbg(bdi->dev, "prop: %d\n", psp);
+
+- pm_runtime_put_sync(bdi->dev);
++ pm_runtime_get_sync(bdi->dev);
+
+ switch (psp) {
+ case POWER_SUPPLY_PROP_ONLINE:
--- /dev/null
+From aa7c8da35d1905d80e840d075f07d26ec90144b5 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Tue, 20 Dec 2016 13:28:27 -0500
+Subject: btrfs: fix error handling when run_delayed_extent_op fails
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit aa7c8da35d1905d80e840d075f07d26ec90144b5 upstream.
+
+In __btrfs_run_delayed_refs, the error path when run_delayed_extent_op
+fails sets locked_ref->processing = 0 but doesn't re-increment
+delayed_refs->num_heads_ready. As a result, we end up triggering
+the WARN_ON in btrfs_select_ref_head.
+
+Fixes: d7df2c796d7 (Btrfs: attach delayed ref updates to delayed ref heads)
+Reported-by: Jon Nelson <jnelson-suse@jamponi.net>
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/extent-tree.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2587,7 +2587,10 @@ static noinline int __btrfs_run_delayed_
+ */
+ if (must_insert_reserved)
+ locked_ref->must_insert_reserved = 1;
++ spin_lock(&delayed_refs->lock);
+ locked_ref->processing = 0;
++ delayed_refs->num_heads_ready++;
++ spin_unlock(&delayed_refs->lock);
+ btrfs_debug(fs_info,
+ "run_delayed_extent_op returned %d",
+ ret);
--- /dev/null
+From d0280996437081dd12ed1e982ac8aeaa62835ec4 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Tue, 20 Dec 2016 13:28:28 -0500
+Subject: btrfs: fix locking when we put back a delayed ref that's too new
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit d0280996437081dd12ed1e982ac8aeaa62835ec4 upstream.
+
+In __btrfs_run_delayed_refs, when we put back a delayed ref that's too
+new, we have already dropped the lock on locked_ref when we set
+->processing = 0.
+
+This patch keeps the lock to cover that assignment.
+
+Fixes: d7df2c796d7 (Btrfs: attach delayed ref updates to delayed ref heads)
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/extent-tree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2537,11 +2537,11 @@ static noinline int __btrfs_run_delayed_
+ if (ref && ref->seq &&
+ btrfs_check_delayed_seq(fs_info, delayed_refs, ref->seq)) {
+ spin_unlock(&locked_ref->lock);
+- btrfs_delayed_ref_unlock(locked_ref);
+ spin_lock(&delayed_refs->lock);
+ locked_ref->processing = 0;
+ delayed_refs->num_heads_ready++;
+ spin_unlock(&delayed_refs->lock);
++ btrfs_delayed_ref_unlock(locked_ref);
+ locked_ref = NULL;
+ cond_resched();
+ count++;
--- /dev/null
+From c090959b9dd8c87703e275079aa4b4a824ba3f8e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 16 Nov 2016 17:31:30 +0000
+Subject: bus: vexpress-config: fix device reference leak
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c090959b9dd8c87703e275079aa4b4a824ba3f8e upstream.
+
+Make sure to drop the reference to the parent device taken by
+class_find_device() after populating the bus.
+
+Fixes: 3b9334ac835b ("mfd: vexpress: Convert custom func API to regmap")
+Acked-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bus/vexpress-config.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/bus/vexpress-config.c
++++ b/drivers/bus/vexpress-config.c
+@@ -171,6 +171,7 @@ static int vexpress_config_populate(stru
+ {
+ struct device_node *bridge;
+ struct device *parent;
++ int ret;
+
+ bridge = of_parse_phandle(node, "arm,vexpress,config-bridge", 0);
+ if (!bridge)
+@@ -182,7 +183,11 @@ static int vexpress_config_populate(stru
+ if (WARN_ON(!parent))
+ return -ENODEV;
+
+- return of_platform_populate(node, NULL, NULL, parent);
++ ret = of_platform_populate(node, NULL, NULL, parent);
++
++ put_device(parent);
++
++ return ret;
+ }
+
+ static int __init vexpress_config_init(void)
--- /dev/null
+From 2bed8a8e70729f996af92042d3ad0f11870acc1f Mon Sep 17 00:00:00 2001
+From: Daniel Jedrychowski <avistel@gmail.com>
+Date: Mon, 12 Dec 2016 09:18:28 +1100
+Subject: Clearing FIFOs in RS485 emulation mode causes subsequent transmits to break
+
+From: Daniel Jedrychowski <avistel@gmail.com>
+
+commit 2bed8a8e70729f996af92042d3ad0f11870acc1f upstream.
+
+When in RS485 emulation mode, __do_stop_tx_rs485() calls
+serial8250_clear_fifos(). This not only clears the FIFOs, but also sets
+all bits in their control register (UART_FCR) to 0.
+
+One of the effects of this is the disabling of the FIFOs, which turns
+them into single-byte holding registers. The rest of the driver doesn't
+know this, which results in the lions share of characters passed into a
+write call to be dropped.
+
+(I can supply logic analyzer screenshots if necessary)
+
+This fix replaces the serial8250_clear_fifos() call to
+serial8250_clear_and_reinit_fifos() - this prevents the "dropped
+characters" issue from manifesting again while retaining the requirement
+of clearing the RX FIFO after transmission if the SER_RS485_RX_DURING_TX
+flag is disabled.
+
+Signed-off-by: Daniel Jedrychowski <avistel@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_port.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -1411,7 +1411,7 @@ static void __do_stop_tx_rs485(struct ua
+ * Enable previously disabled RX interrupts.
+ */
+ if (!(p->port.rs485.flags & SER_RS485_RX_DURING_TX)) {
+- serial8250_clear_fifos(p);
++ serial8250_clear_and_reinit_fifos(p);
+
+ p->ier |= UART_IER_RLSI | UART_IER_RDI;
+ serial_port_out(&p->port, UART_IER, p->ier);
--- /dev/null
+From 8a10c06a20ec8097a68fd7a4a1c0e285095b4d2f Mon Sep 17 00:00:00 2001
+From: Denis Kirjanov <kda@linux-powerpc.org>
+Date: Tue, 8 Nov 2016 05:39:28 -0500
+Subject: cpufreq: powernv: Disable preemption while checking CPU throttling state
+
+From: Denis Kirjanov <kda@linux-powerpc.org>
+
+commit 8a10c06a20ec8097a68fd7a4a1c0e285095b4d2f upstream.
+
+With preemption turned on we can read incorrect throttling state
+while being switched to CPU on a different chip.
+
+ BUG: using smp_processor_id() in preemptible [00000000] code: cat/7343
+ caller is .powernv_cpufreq_throttle_check+0x2c/0x710
+ CPU: 13 PID: 7343 Comm: cat Not tainted 4.8.0-rc5-dirty #1
+ Call Trace:
+ [c0000007d25b75b0] [c000000000971378] .dump_stack+0xe4/0x150 (unreliable)
+ [c0000007d25b7640] [c0000000005162e4] .check_preemption_disabled+0x134/0x150
+ [c0000007d25b76e0] [c0000000007b63ac] .powernv_cpufreq_throttle_check+0x2c/0x710
+ [c0000007d25b7790] [c0000000007b6d18] .powernv_cpufreq_target_index+0x288/0x360
+ [c0000007d25b7870] [c0000000007acee4] .__cpufreq_driver_target+0x394/0x8c0
+ [c0000007d25b7920] [c0000000007b22ac] .cpufreq_set+0x7c/0xd0
+ [c0000007d25b79b0] [c0000000007adf50] .store_scaling_setspeed+0x80/0xc0
+ [c0000007d25b7a40] [c0000000007ae270] .store+0xa0/0x100
+ [c0000007d25b7ae0] [c0000000003566e8] .sysfs_kf_write+0x88/0xb0
+ [c0000007d25b7b70] [c0000000003553b8] .kernfs_fop_write+0x178/0x260
+ [c0000007d25b7c10] [c0000000002ac3cc] .__vfs_write+0x3c/0x1c0
+ [c0000007d25b7cf0] [c0000000002ad584] .vfs_write+0xc4/0x230
+ [c0000007d25b7d90] [c0000000002aeef8] .SyS_write+0x58/0x100
+ [c0000007d25b7e30] [c00000000000bfec] system_call+0x38/0xfc
+
+Fixes: 09a972d16209 (cpufreq: powernv: Report cpu frequency throttling)
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Denis Kirjanov <kda@linux-powerpc.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/powernv-cpufreq.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/cpufreq/powernv-cpufreq.c
++++ b/drivers/cpufreq/powernv-cpufreq.c
+@@ -647,8 +647,14 @@ static int powernv_cpufreq_target_index(
+ if (unlikely(rebooting) && new_index != get_nominal_index())
+ return 0;
+
+- if (!throttled)
++ if (!throttled) {
++ /* we don't want to be preempted while
++ * checking if the CPU frequency has been throttled
++ */
++ preempt_disable();
+ powernv_cpufreq_throttle_check(NULL);
++ preempt_enable();
++ }
+
+ cur_msec = jiffies_to_msecs(get_jiffies_64());
+
--- /dev/null
+From 836c3ce2566fb8c1754f8d7c9534cad9bc8a6879 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Mon, 2 Jan 2017 12:07:37 +0200
+Subject: dmaengine: omap-dma: Fix dynamic lch_map allocation
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit 836c3ce2566fb8c1754f8d7c9534cad9bc8a6879 upstream.
+
+The original patch did not done what it was supposed to be doing and even
+worst it broke legacy boot (OMAP1).
+
+The lch_map size should be the number of available logical channels in sDMA
+and the od->dma_requests should store the number of available DMA request
+lines usable in sDMA.
+
+In legacy mode we do not have a way to get the DMA request count, in that
+case we use OMAP_SDMA_REQUESTS (127), despite the fact that OMAP1510 have
+only 31 DMA request line.
+
+Fixes: 2d1a9a946fae ("dmaengine: omap-dma: Dynamically allocate memory for lch_map")
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Vinod Koul <vinod.koul@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/omap-dma.c | 30 +++++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 9 deletions(-)
+
+--- a/drivers/dma/omap-dma.c
++++ b/drivers/dma/omap-dma.c
+@@ -1339,6 +1339,7 @@ static int omap_dma_probe(struct platfor
+ struct omap_dmadev *od;
+ struct resource *res;
+ int rc, i, irq;
++ u32 lch_count;
+
+ od = devm_kzalloc(&pdev->dev, sizeof(*od), GFP_KERNEL);
+ if (!od)
+@@ -1381,20 +1382,31 @@ static int omap_dma_probe(struct platfor
+ spin_lock_init(&od->lock);
+ spin_lock_init(&od->irq_lock);
+
+- if (!pdev->dev.of_node) {
+- od->dma_requests = od->plat->dma_attr->lch_count;
+- if (unlikely(!od->dma_requests))
+- od->dma_requests = OMAP_SDMA_REQUESTS;
+- } else if (of_property_read_u32(pdev->dev.of_node, "dma-requests",
+- &od->dma_requests)) {
++ /* Number of DMA requests */
++ od->dma_requests = OMAP_SDMA_REQUESTS;
++ if (pdev->dev.of_node && of_property_read_u32(pdev->dev.of_node,
++ "dma-requests",
++ &od->dma_requests)) {
+ dev_info(&pdev->dev,
+ "Missing dma-requests property, using %u.\n",
+ OMAP_SDMA_REQUESTS);
+- od->dma_requests = OMAP_SDMA_REQUESTS;
+ }
+
+- od->lch_map = devm_kcalloc(&pdev->dev, od->dma_requests,
+- sizeof(*od->lch_map), GFP_KERNEL);
++ /* Number of available logical channels */
++ if (!pdev->dev.of_node) {
++ lch_count = od->plat->dma_attr->lch_count;
++ if (unlikely(!lch_count))
++ lch_count = OMAP_SDMA_CHANNELS;
++ } else if (of_property_read_u32(pdev->dev.of_node, "dma-channels",
++ &lch_count)) {
++ dev_info(&pdev->dev,
++ "Missing dma-channels property, using %u.\n",
++ OMAP_SDMA_CHANNELS);
++ lch_count = OMAP_SDMA_CHANNELS;
++ }
++
++ od->lch_map = devm_kcalloc(&pdev->dev, lch_count, sizeof(*od->lch_map),
++ GFP_KERNEL);
+ if (!od->lch_map)
+ return -ENOMEM;
+
--- /dev/null
+From 7192c54a68013f6058b1bb505645fcd07015191c Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 5 Jan 2017 13:02:37 -0500
+Subject: drm/amdgpu: drop verde dpm quirks
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 7192c54a68013f6058b1bb505645fcd07015191c upstream.
+
+Port of radeon change to amdgpu.
+
+Acked-by: Edward O'Callaghan <funfunctor@folklore1984.net>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/si_dpm.c | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+@@ -3485,19 +3485,6 @@ static void si_apply_state_adjust_rules(
+ (adev->pdev->device == 0x6817) ||
+ (adev->pdev->device == 0x6806))
+ max_mclk = 120000;
+- } else if (adev->asic_type == CHIP_VERDE) {
+- if ((adev->pdev->revision == 0x81) ||
+- (adev->pdev->revision == 0x83) ||
+- (adev->pdev->revision == 0x87) ||
+- (adev->pdev->device == 0x6820) ||
+- (adev->pdev->device == 0x6821) ||
+- (adev->pdev->device == 0x6822) ||
+- (adev->pdev->device == 0x6823) ||
+- (adev->pdev->device == 0x682A) ||
+- (adev->pdev->device == 0x682B)) {
+- max_sclk = 75000;
+- max_mclk = 80000;
+- }
+ } else if (adev->asic_type == CHIP_OLAND) {
+ if ((adev->pdev->revision == 0xC7) ||
+ (adev->pdev->revision == 0x80) ||
--- /dev/null
+From 5165484b02f2cbedb5bf3a41ff5e8ae16069016c Mon Sep 17 00:00:00 2001
+From: Flora Cui <Flora.Cui@amd.com>
+Date: Thu, 15 Dec 2016 13:43:59 +0800
+Subject: drm/amdgpu: update si kicker smc firmware
+
+From: Flora Cui <Flora.Cui@amd.com>
+
+commit 5165484b02f2cbedb5bf3a41ff5e8ae16069016c upstream.
+
+Use the appropriate smc firmware for each chip revision.
+Using the wrong one can cause stability issues.
+
+Acked-by: Edward O'Callaghan <funfunctor@folklore1984.net>
+Signed-off-by: Flora Cui <Flora.Cui@amd.com>
+Reviewed-by: Junwei Zhang <Jerry.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/si_dpm.c | 57 +++++++++++++++++-------------------
+ 1 file changed, 28 insertions(+), 29 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+@@ -56,7 +56,6 @@
+ #define BIOS_SCRATCH_4 0x5cd
+
+ MODULE_FIRMWARE("radeon/tahiti_smc.bin");
+-MODULE_FIRMWARE("radeon/tahiti_k_smc.bin");
+ MODULE_FIRMWARE("radeon/pitcairn_smc.bin");
+ MODULE_FIRMWARE("radeon/pitcairn_k_smc.bin");
+ MODULE_FIRMWARE("radeon/verde_smc.bin");
+@@ -7685,49 +7684,49 @@ static int si_dpm_init_microcode(struct
+ chip_name = "tahiti";
+ break;
+ case CHIP_PITCAIRN:
+- if ((adev->pdev->revision == 0x81) ||
+- (adev->pdev->device == 0x6810) ||
+- (adev->pdev->device == 0x6811) ||
+- (adev->pdev->device == 0x6816) ||
+- (adev->pdev->device == 0x6817) ||
+- (adev->pdev->device == 0x6806))
++ if ((adev->pdev->revision == 0x81) &&
++ ((adev->pdev->device == 0x6810) ||
++ (adev->pdev->device == 0x6811)))
+ chip_name = "pitcairn_k";
+ else
+ chip_name = "pitcairn";
+ break;
+ case CHIP_VERDE:
+- if ((adev->pdev->revision == 0x81) ||
+- (adev->pdev->revision == 0x83) ||
+- (adev->pdev->revision == 0x87) ||
+- (adev->pdev->device == 0x6820) ||
+- (adev->pdev->device == 0x6821) ||
+- (adev->pdev->device == 0x6822) ||
+- (adev->pdev->device == 0x6823) ||
+- (adev->pdev->device == 0x682A) ||
+- (adev->pdev->device == 0x682B))
++ if (((adev->pdev->device == 0x6820) &&
++ ((adev->pdev->revision == 0x81) ||
++ (adev->pdev->revision == 0x83))) ||
++ ((adev->pdev->device == 0x6821) &&
++ ((adev->pdev->revision == 0x83) ||
++ (adev->pdev->revision == 0x87))) ||
++ ((adev->pdev->revision == 0x87) &&
++ ((adev->pdev->device == 0x6823) ||
++ (adev->pdev->device == 0x682b))))
+ chip_name = "verde_k";
+ else
+ chip_name = "verde";
+ break;
+ case CHIP_OLAND:
+- if ((adev->pdev->revision == 0xC7) ||
+- (adev->pdev->revision == 0x80) ||
+- (adev->pdev->revision == 0x81) ||
+- (adev->pdev->revision == 0x83) ||
+- (adev->pdev->revision == 0x87) ||
+- (adev->pdev->device == 0x6604) ||
+- (adev->pdev->device == 0x6605))
++ if (((adev->pdev->revision == 0x81) &&
++ ((adev->pdev->device == 0x6600) ||
++ (adev->pdev->device == 0x6604) ||
++ (adev->pdev->device == 0x6605) ||
++ (adev->pdev->device == 0x6610))) ||
++ ((adev->pdev->revision == 0x83) &&
++ (adev->pdev->device == 0x6610)))
+ chip_name = "oland_k";
+ else
+ chip_name = "oland";
+ break;
+ case CHIP_HAINAN:
+- if ((adev->pdev->revision == 0x81) ||
+- (adev->pdev->revision == 0x83) ||
+- (adev->pdev->revision == 0xC3) ||
+- (adev->pdev->device == 0x6664) ||
+- (adev->pdev->device == 0x6665) ||
+- (adev->pdev->device == 0x6667))
++ if (((adev->pdev->revision == 0x81) &&
++ (adev->pdev->device == 0x6660)) ||
++ ((adev->pdev->revision == 0x83) &&
++ ((adev->pdev->device == 0x6660) ||
++ (adev->pdev->device == 0x6663) ||
++ (adev->pdev->device == 0x6665) ||
++ (adev->pdev->device == 0x6667))) ||
++ ((adev->pdev->revision == 0xc3) &&
++ (adev->pdev->device == 0x6665)))
+ chip_name = "hainan_k";
+ else
+ chip_name = "hainan";
--- /dev/null
+From cff52e5fc4cfc978b7df898dc14a0492c7ef0ae8 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 18 Oct 2016 00:13:39 +0200
+Subject: drm: avoid uninitialized timestamp use in wait_vblank
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit cff52e5fc4cfc978b7df898dc14a0492c7ef0ae8 upstream.
+
+gcc warns about the timestamp in drm_wait_vblank being possibly
+used without an initialization:
+
+drivers/gpu/drm/drm_irq.c: In function 'drm_crtc_send_vblank_event':
+drivers/gpu/drm/drm_irq.c:992:24: error: 'now.tv_usec' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+drivers/gpu/drm/drm_irq.c:1069:17: note: 'now.tv_usec' was declared here
+drivers/gpu/drm/drm_irq.c:991:23: error: 'now.tv_sec' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+
+This can happen if drm_vblank_count_and_time() returns 0 in its
+error path. To sanitize the error case, I'm changing that function
+to return a zero timestamp when it fails.
+
+Fixes: e6ae8687a87b ("drm: idiot-proof vblank")
+Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Mario Kleiner <mario.kleiner.de@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20161017221355.1861551-6-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_irq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_irq.c
++++ b/drivers/gpu/drm/drm_irq.c
+@@ -952,8 +952,10 @@ static u32 drm_vblank_count_and_time(str
+ u32 vblank_count;
+ unsigned int seq;
+
+- if (WARN_ON(pipe >= dev->num_crtcs))
++ if (WARN_ON(pipe >= dev->num_crtcs)) {
++ *vblanktime = (struct timeval) { 0 };
+ return 0;
++ }
+
+ do {
+ seq = read_seqbegin(&vblank->seqlock);
--- /dev/null
+From aebe55c2d4b998741c0847ace1b4af47d73c763b Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Date: Tue, 3 Jan 2017 01:14:27 +0200
+Subject: drm: Clean up planes in atomic commit helper failure path
+
+From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+
+commit aebe55c2d4b998741c0847ace1b4af47d73c763b upstream.
+
+If waiting for fences fails for blocking commits, planes must be cleaned
+up before returning.
+
+Fixes: f6ce410a59a4 ("drm/fence: allow fence waiting to be interrupted by userspace")
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170102231427.7192-1-laurent.pinchart@ideasonboard.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_atomic_helper.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_atomic_helper.c
++++ b/drivers/gpu/drm/drm_atomic_helper.c
+@@ -1253,8 +1253,10 @@ int drm_atomic_helper_commit(struct drm_
+
+ if (!nonblock) {
+ ret = drm_atomic_helper_wait_for_fences(dev, state, true);
+- if (ret)
++ if (ret) {
++ drm_atomic_helper_cleanup_planes(dev, state);
+ return ret;
++ }
+ }
+
+ /*
--- /dev/null
+From dccf82ad1775f2b9c36ec85e25e39d88c7e86818 Mon Sep 17 00:00:00 2001
+From: Imre Deak <imre.deak@intel.com>
+Date: Mon, 5 Dec 2016 18:27:38 +0200
+Subject: drm/i915/gen9: Fix PCODE polling during SAGV disabling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Imre Deak <imre.deak@intel.com>
+
+commit dccf82ad1775f2b9c36ec85e25e39d88c7e86818 upstream.
+
+According to the previous patch, it's possible atm that we call
+intel_do_sagv_disable() only once during the 1ms period and time out if
+that call fails. As opposed to this the spec says that we need to keep
+retrying this request for a 1ms duration, so let's do this similarly to
+the CDCLK change notification request.
+
+v4-5:
+- Rebased on the reply_mask, reply change.
+v6:
+- Remove w/s change. (Lyude)
+- Rebased on the timeout_base argument change.
+
+Cc: Lyude <cpaul@redhat.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Fixes: 656d1b89e5ff ("drm/i915/skl: Add support for the SAGV, fix underrun hangs")
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Lyude <lyude@redhat.com> (v4)
+Link: http://patchwork.freedesktop.org/patch/msgid/1480955258-26311-2-git-send-email-imre.deak@intel.com
+(cherry picked from commit b3b8e99984a4eace91bc097e8f8cec71441cae16)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_pm.c | 34 +++++++++-------------------------
+ 1 file changed, 9 insertions(+), 25 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -2955,24 +2955,10 @@ intel_enable_sagv(struct drm_i915_privat
+ return 0;
+ }
+
+-static int
+-intel_do_sagv_disable(struct drm_i915_private *dev_priv)
+-{
+- int ret;
+- uint32_t temp = GEN9_SAGV_DISABLE;
+-
+- ret = sandybridge_pcode_read(dev_priv, GEN9_PCODE_SAGV_CONTROL,
+- &temp);
+- if (ret)
+- return ret;
+- else
+- return temp & GEN9_SAGV_IS_DISABLED;
+-}
+-
+ int
+ intel_disable_sagv(struct drm_i915_private *dev_priv)
+ {
+- int ret, result;
++ int ret;
+
+ if (!intel_has_sagv(dev_priv))
+ return 0;
+@@ -2984,25 +2970,23 @@ intel_disable_sagv(struct drm_i915_priva
+ mutex_lock(&dev_priv->rps.hw_lock);
+
+ /* bspec says to keep retrying for at least 1 ms */
+- ret = wait_for(result = intel_do_sagv_disable(dev_priv), 1);
++ ret = skl_pcode_request(dev_priv, GEN9_PCODE_SAGV_CONTROL,
++ GEN9_SAGV_DISABLE,
++ GEN9_SAGV_IS_DISABLED, GEN9_SAGV_IS_DISABLED,
++ 1);
+ mutex_unlock(&dev_priv->rps.hw_lock);
+
+- if (ret == -ETIMEDOUT) {
+- DRM_ERROR("Request to disable SAGV timed out\n");
+- return -ETIMEDOUT;
+- }
+-
+ /*
+ * Some skl systems, pre-release machines in particular,
+ * don't actually have an SAGV.
+ */
+- if (IS_SKYLAKE(dev_priv) && result == -ENXIO) {
++ if (IS_SKYLAKE(dev_priv) && ret == -ENXIO) {
+ DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n");
+ dev_priv->sagv_status = I915_SAGV_NOT_CONTROLLED;
+ return 0;
+- } else if (result < 0) {
+- DRM_ERROR("Failed to disable the SAGV\n");
+- return result;
++ } else if (ret < 0) {
++ DRM_ERROR("Failed to disable the SAGV (%d)\n", ret);
++ return ret;
+ }
+
+ dev_priv->sagv_status = I915_SAGV_DISABLED;
--- /dev/null
+From imre.deak@intel.com Tue Jan 17 16:22:12 2017
+From: Imre Deak <imre.deak@intel.com>
+Date: Mon, 16 Jan 2017 18:59:46 +0200
+Subject: drm/i915/gen9: Fix PCODE polling timeout in stable backport
+To: Thomas Backlund <tmb@mageia.org>
+Cc: gregkh@linuxfoundation.org, arthur.j.runyan@intel.com, chris@chris-wilson.co.uk, jani.nikula@intel.com, stable@vger.kernel.org, ville.syrjala@linux.intel.com, stable-commits@vger.kernel.org
+Message-ID: <20170116165946.GB4514@ideak-desk.fi.intel.com>
+Content-Disposition: inline
+
+From: Imre Deak <imre.deak@intel.com>
+
+The backport of
+2c7d0602c - "Fix PCODE polling during CDCLK change notification"
+to the 4.9 stable tree used an incorrect timeout value. Fix this up
+so the backport matches the upstream commit.
+
+Reported-by: Thomas Backlund <tmb@mageia.org>
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/intel_pm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_pm.c
++++ b/drivers/gpu/drm/i915/intel_pm.c
+@@ -8015,14 +8015,14 @@ int skl_pcode_request(struct drm_i915_pr
+ * worst case) _and_ PCODE was busy for some reason even after a
+ * (queued) request and @timeout_base_ms delay. As a workaround retry
+ * the poll with preemption disabled to maximize the number of
+- * requests. Increase the timeout from @timeout_base_ms to 50ms to
++ * requests. Increase the timeout from @timeout_base_ms to 10ms to
+ * account for interrupts that could reduce the number of these
+ * requests.
+ */
+ DRM_DEBUG_KMS("PCODE timeout, retrying with preemption disabled\n");
+ WARN_ON_ONCE(timeout_base_ms > 3);
+ preempt_disable();
+- ret = wait_for_atomic(COND, 50);
++ ret = wait_for_atomic(COND, 10);
+ preempt_enable();
+
+ out:
--- /dev/null
+From 00b2b7288299a8c73c0c37b531a075ba5c849e67 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 20 Dec 2016 17:39:02 +0200
+Subject: drm/i915: Move the min_pixclk[] handling to the end of readout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 00b2b7288299a8c73c0c37b531a075ba5c849e67 upstream.
+
+Trying to determine the pixel rate of the pipe can't be done until we
+know the clock, which means it can't be done until the encoder
+.get_config() hooks have been called. So let's move the min_pixclk[]
+stuff to the end of intel_modeset_readout_hw_state() when we actually
+have gathered all the required infromation.
+
+Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+Cc: Mika Kahola <mika.kahola@intel.com>
+Cc: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira@intel.com>
+Fixes: 565602d7501a ("drm/i915: Do not acquire crtc state to check clock during modeset, v4.")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20161220153902.15621-1-ville.syrjala@linux.intel.com
+Reviewed-by: Ander Conselvan de Oliveira <conselvan2@gmail.com>
+Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
+(cherry picked from commit aca1ebf491518910df156f3dab6a66306bb52e28)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -16749,7 +16749,6 @@ static void intel_modeset_readout_hw_sta
+
+ for_each_intel_crtc(dev, crtc) {
+ struct intel_crtc_state *crtc_state = crtc->config;
+- int pixclk = 0;
+
+ __drm_atomic_helper_crtc_destroy_state(&crtc_state->base);
+ memset(crtc_state, 0, sizeof(*crtc_state));
+@@ -16761,23 +16760,9 @@ static void intel_modeset_readout_hw_sta
+ crtc->base.enabled = crtc_state->base.enable;
+ crtc->active = crtc_state->base.active;
+
+- if (crtc_state->base.active) {
++ if (crtc_state->base.active)
+ dev_priv->active_crtcs |= 1 << crtc->pipe;
+
+- if (INTEL_GEN(dev_priv) >= 9 || IS_BROADWELL(dev_priv))
+- pixclk = ilk_pipe_pixel_rate(crtc_state);
+- else if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
+- pixclk = crtc_state->base.adjusted_mode.crtc_clock;
+- else
+- WARN_ON(dev_priv->display.modeset_calc_cdclk);
+-
+- /* pixel rate mustn't exceed 95% of cdclk with IPS on BDW */
+- if (IS_BROADWELL(dev_priv) && crtc_state->ips_enabled)
+- pixclk = DIV_ROUND_UP(pixclk * 100, 95);
+- }
+-
+- dev_priv->min_pixclk[crtc->pipe] = pixclk;
+-
+ readout_plane_state(crtc);
+
+ DRM_DEBUG_KMS("[CRTC:%d:%s] hw state readout: %s\n",
+@@ -16851,6 +16836,8 @@ static void intel_modeset_readout_hw_sta
+ }
+
+ for_each_intel_crtc(dev, crtc) {
++ int pixclk = 0;
++
+ crtc->base.hwmode = crtc->config->base.adjusted_mode;
+
+ memset(&crtc->base.mode, 0, sizeof(crtc->base.mode));
+@@ -16878,10 +16865,23 @@ static void intel_modeset_readout_hw_sta
+ */
+ crtc->base.state->mode.private_flags = I915_MODE_FLAG_INHERITED;
+
++ if (INTEL_GEN(dev_priv) >= 9 || IS_BROADWELL(dev_priv))
++ pixclk = ilk_pipe_pixel_rate(crtc->config);
++ else if (IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv))
++ pixclk = crtc->config->base.adjusted_mode.crtc_clock;
++ else
++ WARN_ON(dev_priv->display.modeset_calc_cdclk);
++
++ /* pixel rate mustn't exceed 95% of cdclk with IPS on BDW */
++ if (IS_BROADWELL(dev_priv) && crtc->config->ips_enabled)
++ pixclk = DIV_ROUND_UP(pixclk * 100, 95);
++
+ drm_calc_timestamping_constants(&crtc->base, &crtc->base.hwmode);
+ update_scanline_offset(crtc);
+ }
+
++ dev_priv->min_pixclk[crtc->pipe] = pixclk;
++
+ intel_pipe_config_sanity_check(dev_priv, crtc->config);
+ }
+ }
--- /dev/null
+From cc98e6ce6abe1c0103cbd7aff1ee586622a9361e Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Wed, 30 Nov 2016 20:51:26 +0000
+Subject: drm: Initialise drm_mm.head_node.allocated
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit cc98e6ce6abe1c0103cbd7aff1ee586622a9361e upstream.
+
+commit 202b52b7fbf7 ("drm: Track drm_mm nodes with an interval tree")
+introduced a requirement that the special drm_mm.head_node was
+initialised and marked as not being allocated. It is a very special node
+that has no side but has a hole that represents the drm_mm address
+space, and holds the list of nodes. Since it is not a real node, it is
+not part of the node rbtree and we detect this as it being unallocated.
+This presumed that drm_mm_init() was initialising it to zero. It happens
+that i915 kzallocs its objects and so it was accidentally setting it,
+but for generic use we cannot make that assumption.
+
+[ 22.981519] general protection fault: 0000 [#1] SMP
+[ 22.981521] Modules linked in: test_drm_mm(+) ctr ccm arc4 rt2800usb rt2x00usb rt2800lib rt2x00lib crc_ccitt mac80211 cmac rfcomm bnep snd_hda_codec_realtek snd_hda_codec_hdmi snd_hda_codec_generic snd_hda_intel dcdbas snd_hda_codec x86_pkg_temp_thermal intel_powerclamp btusb snd_hda_core coretemp crct10dif_pclmul cfg80211 btrtl btbcm btintel bluetooth crc32_pclmul ghash_clmulni_intel aesni_intel snd_pcm i2c_hid aes_x86_64 lrw gf128mul glue_helper ablk_helper cryptd snd_timer hid_multitouch snd joydev serio_raw lpc_ich mfd_core i2c_designware_platform i2c_designware_core 8250_dw binfmt_misc soundcore acpi_pad nls_iso8859_1 usbhid hid psmouse ahci libahci [last unloaded: test_drm_mm]
+[ 22.981544] CPU: 1 PID: 2088 Comm: drm_mm Tainted: G W 4.9.0-rc7+ #234
+[ 22.981545] Hardware name: Dell Inc. XPS 13 9343/0310JH, BIOS A07 11/11/2015
+[ 22.981546] task: ffff88020c971cc0 task.stack: ffffc90001728000
+[ 22.981547] RIP: 0010:[<ffffffff814050f0>] [<ffffffff814050f0>] drm_mm_interval_tree_add_node+0xa0/0xd0
+[ 22.981551] RSP: 0018:ffffc9000172ba98 EFLAGS: 00010202
+[ 22.981552] RAX: 0f0000c69cf63d80 RBX: ffff88020be00000 RCX: ffff88020be00000
+[ 22.981553] RDX: 0000000000000fff RSI: ffffc9000172bc48 RDI: ffffffff810ac4df
+[ 22.981553] RBP: ffffc9000172bb08 R08: ffffc9000172bc70 R09: 0000000000000fff
+[ 22.981554] R10: ffffffff810ac4d7 R11: 4dc04d8b4cffffe5 R12: 0000000000001000
+[ 22.981555] R13: ffffc9000172bbd0 R14: ffffc9000172bbe0 R15: 0000000002000000
+[ 22.981556] FS: 00007f80c9fab740(0000) GS:ffff88021f480000(0000) knlGS:0000000000000000
+[ 22.981557] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 22.981558] CR2: 00007f80c9fd5000 CR3: 000000020c191000 CR4: 00000000003406e0
+[ 22.981559] Stack:
+[ 22.981560] ffffffff81405d09 ffff88020be00000 ffffc9000172bbe0 000000000172bb08
+[ 22.981562] ffffffffffffffff 0000000000000000 0000000000000000 0000000000000000
+[ 22.981563] 0000000002000000 0000000002000000 ffffffffa02f3000 ffff88020be00000
+[ 22.981565] Call Trace:
+[ 22.981568] [<ffffffff81405d09>] ? drm_mm_insert_node_generic+0x229/0x310
+[ 22.981570] [<ffffffffa02f3000>] ? 0xffffffffa02f3000
+[ 22.981572] [<ffffffffa02903c1>] __subtest_insert_range.constprop.7+0xd1/0x5b0 [test_drm_mm]
+[ 22.981575] [<ffffffff81081222>] ? default_wake_function+0x12/0x20
+[ 22.981576] [<ffffffff81096905>] ? __wake_up_common+0x55/0x90
+[ 22.981578] [<ffffffff81085f42>] ? sched_clock_cpu+0x72/0xa0
+[ 22.981581] [<ffffffff811308ad>] ? irq_work_queue+0xd/0x80
+[ 22.981582] [<ffffffff810abcc4>] ? wake_up_klogd+0x34/0x40
+[ 22.981584] [<ffffffff810ac19d>] ? console_unlock+0x4cd/0x530
+[ 22.981585] [<ffffffff810ac4d7>] ? vprintk_emit+0x2d7/0x490
+[ 22.981587] [<ffffffff810ac82f>] ? vprintk_default+0x1f/0x30
+[ 22.981589] [<ffffffff81146e1c>] ? printk+0x4d/0x4f
+[ 22.981590] [<ffffffffa02f3000>] ? 0xffffffffa02f3000
+[ 22.981592] [<ffffffffa02908b5>] subtest_insert_range+0x15/0x80 [test_drm_mm]
+[ 22.981594] [<ffffffffa02f3088>] test_drm_mm_init+0x88/0x1000 [test_drm_mm]
+[ 22.981597] [<ffffffff8100043d>] do_one_initcall+0x3d/0x150
+[ 22.981600] [<ffffffff8119dfbf>] ? kfree+0x13f/0x180
+[ 22.981602] [<ffffffff811471f2>] do_init_module+0x60/0x1f1
+[ 22.981606] [<ffffffff810db878>] load_module+0x2228/0x2790
+[ 22.981608] [<ffffffff810d8590>] ? __symbol_put+0x40/0x40
+[ 22.981612] [<ffffffff811c52b1>] ? kernel_read+0x41/0x60
+[ 22.981614] [<ffffffff810dbfb6>] SYSC_finit_module+0x96/0xd0
+[ 22.981617] [<ffffffff810dc00e>] SyS_finit_module+0xe/0x10
+[ 22.981620] [<ffffffff816e7aa4>] entry_SYSCALL_64_fastpath+0x17/0x98
+[ 22.981622] Code: c7 41 30 00 00 00 00 48 89 e5 48 89 3a 48 c7 c2 20 4e 40 81 e8 b2 a1 f0 ff 5d c3 48 8d 56 78 45 31 d2 48 89 d6 eb 25 48 8b 51 58 <48> 39 50 38 73 04 48 89 50 38 4c 8b 58 28 4c 39 59 48 48 8d 50
+[ 22.981651] RIP [<ffffffff814050f0>] drm_mm_interval_tree_add_node+0xa0/0xd0
+[ 22.981655] RSP <ffffc9000172ba98>
+
+Testcase: igt/drm_mm
+Fixes: 202b52b7fbf7 ("drm: Track drm_mm nodes with an interval tree")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: David Herrmann <dh.herrmann@gmail.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: <drm-intel-fixes@lists.freedesktop.org> # v4.9-rc1+
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20161130205126.31106-1-chris@chris-wilson.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_mm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/gpu/drm/drm_mm.c
++++ b/drivers/gpu/drm/drm_mm.c
+@@ -839,6 +839,7 @@ void drm_mm_init(struct drm_mm * mm, u64
+
+ /* Clever trick to avoid a special case in the free hole tracking. */
+ INIT_LIST_HEAD(&mm->head_node.node_list);
++ mm->head_node.allocated = 0;
+ mm->head_node.hole_follows = 1;
+ mm->head_node.scanned_block = 0;
+ mm->head_node.scanned_prev_free = 0;
--- /dev/null
+From 230c5b44233ff0543c0b5ccf4ff9400057010fbe Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Mon, 24 Oct 2016 21:21:15 +0800
+Subject: drm/panel: simple: Check against num_timings when setting preferred for timing
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 230c5b44233ff0543c0b5ccf4ff9400057010fbe upstream.
+
+In the loop on .timings, we should check .num_timings to see if it's the
+only mode specified, not .num_modes, which should be used with .modes.
+
+Fixes: cda553725c92 ("drm/panel: simple: Set appropriate mode type")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/panel/panel-simple.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -120,7 +120,7 @@ static int panel_simple_get_fixed_modes(
+
+ mode->type |= DRM_MODE_TYPE_DRIVER;
+
+- if (panel->desc->num_modes == 1)
++ if (panel->desc->num_timings == 1)
+ mode->type |= DRM_MODE_TYPE_PREFERRED;
+
+ drm_mode_probed_add(connector, mode);
--- /dev/null
+From 8a08403bcb39f5d0e733bcf59a8a74f16b538f6e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 5 Jan 2017 12:39:01 -0500
+Subject: drm/radeon: drop verde dpm quirks
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 8a08403bcb39f5d0e733bcf59a8a74f16b538f6e upstream.
+
+fixes:
+https://bugs.freedesktop.org/show_bug.cgi?id=98897
+https://bugs.launchpad.net/bugs/1651981
+
+Acked-by: Edward O'Callaghan <funfunctor@folklore1984.net>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: Adrian Fiergolski <A.Fiergolski@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -3008,19 +3008,6 @@ static void si_apply_state_adjust_rules(
+ (rdev->pdev->device == 0x6817) ||
+ (rdev->pdev->device == 0x6806))
+ max_mclk = 120000;
+- } else if (rdev->family == CHIP_VERDE) {
+- if ((rdev->pdev->revision == 0x81) ||
+- (rdev->pdev->revision == 0x83) ||
+- (rdev->pdev->revision == 0x87) ||
+- (rdev->pdev->device == 0x6820) ||
+- (rdev->pdev->device == 0x6821) ||
+- (rdev->pdev->device == 0x6822) ||
+- (rdev->pdev->device == 0x6823) ||
+- (rdev->pdev->device == 0x682A) ||
+- (rdev->pdev->device == 0x682B)) {
+- max_sclk = 75000;
+- max_mclk = 80000;
+- }
+ } else if (rdev->family == CHIP_OLAND) {
+ if ((rdev->pdev->revision == 0xC7) ||
+ (rdev->pdev->revision == 0x80) ||
--- /dev/null
+From 6458bd4dfd9414cba5804eb9907fe2a824278c34 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Thu, 5 Jan 2017 12:15:52 -0500
+Subject: drm/radeon: update smc firmware selection for SI
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 6458bd4dfd9414cba5804eb9907fe2a824278c34 upstream.
+
+Use the appropriate smc firmware for each chip revision.
+Using the wrong one can cause stability issues.
+
+Acked-by: Edward O'Callaghan <funfunctor@folklore1984.net>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si.c | 60 ++++++++++++++++++++------------------------
+ 1 file changed, 28 insertions(+), 32 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -50,7 +50,6 @@ MODULE_FIRMWARE("radeon/tahiti_ce.bin");
+ MODULE_FIRMWARE("radeon/tahiti_mc.bin");
+ MODULE_FIRMWARE("radeon/tahiti_rlc.bin");
+ MODULE_FIRMWARE("radeon/tahiti_smc.bin");
+-MODULE_FIRMWARE("radeon/tahiti_k_smc.bin");
+
+ MODULE_FIRMWARE("radeon/PITCAIRN_pfp.bin");
+ MODULE_FIRMWARE("radeon/PITCAIRN_me.bin");
+@@ -1657,9 +1656,6 @@ static int si_init_microcode(struct rade
+ switch (rdev->family) {
+ case CHIP_TAHITI:
+ chip_name = "TAHITI";
+- /* XXX: figure out which Tahitis need the new ucode */
+- if (0)
+- new_smc = true;
+ new_chip_name = "tahiti";
+ pfp_req_size = SI_PFP_UCODE_SIZE * 4;
+ me_req_size = SI_PM4_UCODE_SIZE * 4;
+@@ -1671,12 +1667,9 @@ static int si_init_microcode(struct rade
+ break;
+ case CHIP_PITCAIRN:
+ chip_name = "PITCAIRN";
+- if ((rdev->pdev->revision == 0x81) ||
+- (rdev->pdev->device == 0x6810) ||
+- (rdev->pdev->device == 0x6811) ||
+- (rdev->pdev->device == 0x6816) ||
+- (rdev->pdev->device == 0x6817) ||
+- (rdev->pdev->device == 0x6806))
++ if ((rdev->pdev->revision == 0x81) &&
++ ((rdev->pdev->device == 0x6810) ||
++ (rdev->pdev->device == 0x6811)))
+ new_smc = true;
+ new_chip_name = "pitcairn";
+ pfp_req_size = SI_PFP_UCODE_SIZE * 4;
+@@ -1689,15 +1682,15 @@ static int si_init_microcode(struct rade
+ break;
+ case CHIP_VERDE:
+ chip_name = "VERDE";
+- if ((rdev->pdev->revision == 0x81) ||
+- (rdev->pdev->revision == 0x83) ||
+- (rdev->pdev->revision == 0x87) ||
+- (rdev->pdev->device == 0x6820) ||
+- (rdev->pdev->device == 0x6821) ||
+- (rdev->pdev->device == 0x6822) ||
+- (rdev->pdev->device == 0x6823) ||
+- (rdev->pdev->device == 0x682A) ||
+- (rdev->pdev->device == 0x682B))
++ if (((rdev->pdev->device == 0x6820) &&
++ ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83))) ||
++ ((rdev->pdev->device == 0x6821) &&
++ ((rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->revision == 0x87))) ||
++ ((rdev->pdev->revision == 0x87) &&
++ ((rdev->pdev->device == 0x6823) ||
++ (rdev->pdev->device == 0x682b))))
+ new_smc = true;
+ new_chip_name = "verde";
+ pfp_req_size = SI_PFP_UCODE_SIZE * 4;
+@@ -1710,13 +1703,13 @@ static int si_init_microcode(struct rade
+ break;
+ case CHIP_OLAND:
+ chip_name = "OLAND";
+- if ((rdev->pdev->revision == 0xC7) ||
+- (rdev->pdev->revision == 0x80) ||
+- (rdev->pdev->revision == 0x81) ||
+- (rdev->pdev->revision == 0x83) ||
+- (rdev->pdev->revision == 0x87) ||
+- (rdev->pdev->device == 0x6604) ||
+- (rdev->pdev->device == 0x6605))
++ if (((rdev->pdev->revision == 0x81) &&
++ ((rdev->pdev->device == 0x6600) ||
++ (rdev->pdev->device == 0x6604) ||
++ (rdev->pdev->device == 0x6605) ||
++ (rdev->pdev->device == 0x6610))) ||
++ ((rdev->pdev->revision == 0x83) &&
++ (rdev->pdev->device == 0x6610)))
+ new_smc = true;
+ new_chip_name = "oland";
+ pfp_req_size = SI_PFP_UCODE_SIZE * 4;
+@@ -1728,12 +1721,15 @@ static int si_init_microcode(struct rade
+ break;
+ case CHIP_HAINAN:
+ chip_name = "HAINAN";
+- if ((rdev->pdev->revision == 0x81) ||
+- (rdev->pdev->revision == 0x83) ||
+- (rdev->pdev->revision == 0xC3) ||
+- (rdev->pdev->device == 0x6664) ||
+- (rdev->pdev->device == 0x6665) ||
+- (rdev->pdev->device == 0x6667))
++ if (((rdev->pdev->revision == 0x81) &&
++ (rdev->pdev->device == 0x6660)) ||
++ ((rdev->pdev->revision == 0x83) &&
++ ((rdev->pdev->device == 0x6660) ||
++ (rdev->pdev->device == 0x6663) ||
++ (rdev->pdev->device == 0x6665) ||
++ (rdev->pdev->device == 0x6667))) ||
++ ((rdev->pdev->revision == 0xc3) &&
++ (rdev->pdev->device == 0x6665)))
+ new_smc = true;
+ new_chip_name = "hainan";
+ pfp_req_size = SI_PFP_UCODE_SIZE * 4;
--- /dev/null
+From 5b11ebedd6a8bb4271b796e498cd15c0fe1133b6 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Sat, 3 Dec 2016 16:56:49 +0800
+Subject: extcon: return error code on failure
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 5b11ebedd6a8bb4271b796e498cd15c0fe1133b6 upstream.
+
+Function get_zeroed_page() returns a NULL pointer if there is no enough
+memory. In function extcon_sync(), it returns 0 if the call to
+get_zeroed_page() fails. The return value 0 indicates success in the
+context, which is incosistent with the execution status. This patch
+fixes the bug by returning -ENOMEM.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188611
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Fixes: a580982f0836e
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/extcon/extcon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/extcon/extcon.c
++++ b/drivers/extcon/extcon.c
+@@ -453,7 +453,7 @@ int extcon_sync(struct extcon_dev *edev,
+ dev_err(&edev->dev, "out of memory in extcon_set_state\n");
+ kobject_uevent(&edev->dev.kobj, KOBJ_CHANGE);
+
+- return 0;
++ return -ENOMEM;
+ }
+
+ length = name_show(&edev->dev, NULL, prop_buf);
--- /dev/null
+From 7f638c1cb0a1112dbe0b682a42db30521646686b Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Sat, 17 Dec 2016 12:10:56 +0000
+Subject: i2c: mux: pca954x: fix i2c mux selection caching
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+commit 7f638c1cb0a1112dbe0b682a42db30521646686b upstream.
+
+smbus functions return -ve on error, 0 on success. However,
+__i2c_transfer() have a different return signature - -ve on error, or
+number of buffers transferred (which may be zero or greater.)
+
+The upshot of this is that the sense of the test is reversed when using
+the mux on a bus supporting the master_xfer method: we cache the value
+and never retry if we fail to transfer any buffers, but if we succeed,
+we clear the cached value.
+
+Fix this by making pca954x_reg_write() return a negative error code for
+all failure cases.
+
+Fixes: 463e8f845cbf ("i2c: mux: pca954x: retry updating the mux selection on failure")
+Acked-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/muxes/i2c-mux-pca954x.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
++++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
+@@ -151,6 +151,9 @@ static int pca954x_reg_write(struct i2c_
+ buf[0] = val;
+ msg.buf = buf;
+ ret = __i2c_transfer(adap, &msg, 1);
++
++ if (ret >= 0 && ret != 1)
++ ret = -EREMOTEIO;
+ } else {
+ union i2c_smbus_data data;
+ ret = adap->algo->smbus_xfer(adap, client->addr,
+@@ -179,7 +182,7 @@ static int pca954x_select_chan(struct i2
+ /* Only select the channel if its different from the last channel */
+ if (data->last_chan != regval) {
+ ret = pca954x_reg_write(muxc->parent, client, regval);
+- data->last_chan = ret ? 0 : regval;
++ data->last_chan = ret < 0 ? 0 : regval;
+ }
+
+ return ret;
--- /dev/null
+From 701dc207bf551d9fe6defa36e84a911e880398c3 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ricardo.ribalda@gmail.com>
+Date: Wed, 11 Jan 2017 10:11:44 +0100
+Subject: i2c: piix4: Avoid race conditions with IMC
+
+From: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+
+commit 701dc207bf551d9fe6defa36e84a911e880398c3 upstream.
+
+On AMD's SB800 and upwards, the SMBus is shared with the Integrated
+Micro Controller (IMC).
+
+The platform provides a hardware semaphore to avoid race conditions
+among them. (Check page 288 of the SB800-Series Southbridges Register
+Reference Guide http://support.amd.com/TechDocs/45482.pdf)
+
+Without this patch, many access to the SMBus end with an invalid
+transaction or even with the bus stalled.
+
+Reported-by: Alexandre Desnoyers <alex@qtec.com>
+Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>:
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-piix4.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-piix4.c
++++ b/drivers/i2c/busses/i2c-piix4.c
+@@ -585,10 +585,29 @@ static s32 piix4_access_sb800(struct i2c
+ u8 command, int size, union i2c_smbus_data *data)
+ {
+ struct i2c_piix4_adapdata *adapdata = i2c_get_adapdata(adap);
++ unsigned short piix4_smba = adapdata->smba;
++ int retries = MAX_TIMEOUT;
++ int smbslvcnt;
+ u8 smba_en_lo;
+ u8 port;
+ int retval;
+
++ /* Request the SMBUS semaphore, avoid conflicts with the IMC */
++ smbslvcnt = inb_p(SMBSLVCNT);
++ do {
++ outb_p(smbslvcnt | 0x10, SMBSLVCNT);
++
++ /* Check the semaphore status */
++ smbslvcnt = inb_p(SMBSLVCNT);
++ if (smbslvcnt & 0x10)
++ break;
++
++ usleep_range(1000, 2000);
++ } while (--retries);
++ /* SMBus is still owned by the IMC, we give up */
++ if (!retries)
++ return -EBUSY;
++
+ mutex_lock(&piix4_mutex_sb800);
+
+ outb_p(piix4_port_sel_sb800, SB800_PIIX4_SMB_IDX);
+@@ -606,6 +625,9 @@ static s32 piix4_access_sb800(struct i2c
+
+ mutex_unlock(&piix4_mutex_sb800);
+
++ /* Release the semaphore */
++ outb_p(smbslvcnt | 0x20, SMBSLVCNT);
++
+ return retval;
+ }
+
--- /dev/null
+From 7c9d8d0c41b3e24473ac7648a7fc2d644ccf08ff Mon Sep 17 00:00:00 2001
+From: "Bryant G. Ly" <bgly@us.ibm.com>
+Date: Mon, 9 Jan 2017 10:21:20 -0600
+Subject: ibmvscsis: Fix srp_transfer_data fail return code
+
+From: Bryant G. Ly <bgly@us.ibm.com>
+
+commit 7c9d8d0c41b3e24473ac7648a7fc2d644ccf08ff upstream.
+
+If srp_transfer_data fails within ibmvscsis_write_pending, then
+the most likely scenario is that the client timed out the op and
+removed the TCE mapping. Thus it will loop forever retrying the
+op that is pretty much guaranteed to fail forever. A better return
+code would be EIO instead of EAGAIN.
+
+Reported-by: Steven Royer <seroyer@linux.vnet.ibm.com>
+Tested-by: Steven Royer <seroyer@linux.vnet.ibm.com>
+Signed-off-by: Bryant G. Ly <bgly@us.ibm.com>
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
++++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c
+@@ -3702,7 +3702,7 @@ static int ibmvscsis_write_pending(struc
+ 1, 1);
+ if (rc) {
+ pr_err("srp_transfer_data() failed: %d\n", rc);
+- return -EAGAIN;
++ return -EIO;
+ }
+ /*
+ * We now tell TCM to add this WRITE CDB directly into the TCM storage
--- /dev/null
+From 15f7e3c21b76598bc6e5816d2577ce843b2b963f Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Sat, 17 Sep 2016 00:41:37 +0000
+Subject: iw_cxgb4: Fix error return code in c4iw_rdev_open()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit 15f7e3c21b76598bc6e5816d2577ce843b2b963f upstream.
+
+Fix to return error code -ENOMEM from the __get_free_page() error
+handling case instead of 0, as done elsewhere in this function.
+
+Fixes: 05eb23893c2c ("cxgb4/iw_cxgb4: Doorbell Drop Avoidance Bug Fixes")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Acked-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb4/device.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/cxgb4/device.c
++++ b/drivers/infiniband/hw/cxgb4/device.c
+@@ -828,8 +828,10 @@ static int c4iw_rdev_open(struct c4iw_rd
+ }
+ rdev->status_page = (struct t4_dev_status_page *)
+ __get_free_page(GFP_KERNEL);
+- if (!rdev->status_page)
++ if (!rdev->status_page) {
++ err = -ENOMEM;
+ goto destroy_ocqp_pool;
++ }
+ rdev->status_page->qp_start = rdev->lldi.vr->qp.start;
+ rdev->status_page->qp_size = rdev->lldi.vr->qp.size;
+ rdev->status_page->cq_start = rdev->lldi.vr->cq.start;
--- /dev/null
+From 2df26639e708a88dcc22171949da638a9998f3bc Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.com>
+Date: Tue, 10 Jan 2017 16:57:39 -0800
+Subject: mm: fix remote numa hits statistics
+
+From: Michal Hocko <mhocko@suse.com>
+
+commit 2df26639e708a88dcc22171949da638a9998f3bc upstream.
+
+Jia He has noticed that commit b9f00e147f27 ("mm, page_alloc: reduce
+branches in zone_statistics") has an unintentional side effect that
+remote node allocation requests are accounted as NUMA_MISS rathat than
+NUMA_HIT and NUMA_OTHER if such a request doesn't use __GFP_OTHER_NODE.
+
+There are many of these potentially because the flag is used very rarely
+while we have many users of __alloc_pages_node.
+
+Fix this by simply ignoring __GFP_OTHER_NODE (it can be removed in a
+follow up patch) and treat all allocations that were satisfied from the
+preferred zone's node as NUMA_HITS because this is the same node we
+requested the allocation from in most cases. If this is not the local
+node then we just account it as NUMA_OTHER rather than NUMA_LOCAL.
+
+One downsize would be that an allocation request for a node which is
+outside of the mempolicy nodemask would be reported as a hit which is a
+bit weird but that was the case before b9f00e147f27 already.
+
+Fixes: b9f00e147f27 ("mm, page_alloc: reduce branches in zone_statistics")
+Link: http://lkml.kernel.org/r/20170102153057.9451-2-mhocko@kernel.org
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Reported-by: Jia He <hejianet@gmail.com>
+Reviewed-by: Vlastimil Babka <vbabka@suse.cz> # with cbmc[1] superpowers
+Acked-by: Mel Gorman <mgorman@suse.de>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Taku Izumi <izumi.taku@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/page_alloc.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2556,30 +2556,23 @@ int __isolate_free_page(struct page *pag
+ * Update NUMA hit/miss statistics
+ *
+ * Must be called with interrupts disabled.
+- *
+- * When __GFP_OTHER_NODE is set assume the node of the preferred
+- * zone is the local node. This is useful for daemons who allocate
+- * memory on behalf of other processes.
+ */
+ static inline void zone_statistics(struct zone *preferred_zone, struct zone *z,
+ gfp_t flags)
+ {
+ #ifdef CONFIG_NUMA
+- int local_nid = numa_node_id();
+ enum zone_stat_item local_stat = NUMA_LOCAL;
+
+- if (unlikely(flags & __GFP_OTHER_NODE)) {
++ if (z->node != numa_node_id())
+ local_stat = NUMA_OTHER;
+- local_nid = preferred_zone->node;
+- }
+
+- if (z->node == local_nid) {
++ if (z->node == preferred_zone->node)
+ __inc_zone_state(z, NUMA_HIT);
+- __inc_zone_state(z, local_stat);
+- } else {
++ else {
+ __inc_zone_state(z, NUMA_MISS);
+ __inc_zone_state(preferred_zone, NUMA_FOREIGN);
+ }
++ __inc_zone_state(z, local_stat);
+ #endif
+ }
+
--- /dev/null
+From dc5367bcc556e97555fc94a32cd1aadbebdff47e Mon Sep 17 00:00:00 2001
+From: Julian Wiedmann <jwi@linux.vnet.ibm.com>
+Date: Tue, 10 Jan 2017 17:10:34 +0100
+Subject: net/af_iucv: don't use paged skbs for TX on HiperSockets
+
+From: Julian Wiedmann <jwi@linux.vnet.ibm.com>
+
+commit dc5367bcc556e97555fc94a32cd1aadbebdff47e upstream.
+
+With commit e53743994e21
+("af_iucv: use paged SKBs for big outbound messages"),
+we transmit paged skbs for both of AF_IUCV's transport modes
+(IUCV or HiperSockets).
+The qeth driver for Layer 3 HiperSockets currently doesn't
+support NETIF_F_SG, so these skbs would just be linearized again
+by the stack.
+Avoid that overhead by using paged skbs only for IUCV transport.
+
+cc stable, since this also circumvents a significant skb leak when
+sending large messages (where the skb then needs to be linearized).
+
+Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
+Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
+Fixes: e53743994e21 ("af_iucv: use paged SKBs for big outbound messages")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/iucv/af_iucv.c | 25 ++++++++++++++-----------
+ 1 file changed, 14 insertions(+), 11 deletions(-)
+
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1036,7 +1036,8 @@ static int iucv_sock_sendmsg(struct sock
+ {
+ struct sock *sk = sock->sk;
+ struct iucv_sock *iucv = iucv_sk(sk);
+- size_t headroom, linear;
++ size_t headroom = 0;
++ size_t linear;
+ struct sk_buff *skb;
+ struct iucv_message txmsg = {0};
+ struct cmsghdr *cmsg;
+@@ -1114,18 +1115,20 @@ static int iucv_sock_sendmsg(struct sock
+ * this is fine for SOCK_SEQPACKET (unless we want to support
+ * segmented records using the MSG_EOR flag), but
+ * for SOCK_STREAM we might want to improve it in future */
+- headroom = (iucv->transport == AF_IUCV_TRANS_HIPER)
+- ? sizeof(struct af_iucv_trans_hdr) + ETH_HLEN : 0;
+- if (headroom + len < PAGE_SIZE) {
++ if (iucv->transport == AF_IUCV_TRANS_HIPER) {
++ headroom = sizeof(struct af_iucv_trans_hdr) + ETH_HLEN;
+ linear = len;
+ } else {
+- /* In nonlinear "classic" iucv skb,
+- * reserve space for iucv_array
+- */
+- if (iucv->transport != AF_IUCV_TRANS_HIPER)
+- headroom += sizeof(struct iucv_array) *
+- (MAX_SKB_FRAGS + 1);
+- linear = PAGE_SIZE - headroom;
++ if (len < PAGE_SIZE) {
++ linear = len;
++ } else {
++ /* In nonlinear "classic" iucv skb,
++ * reserve space for iucv_array
++ */
++ headroom = sizeof(struct iucv_array) *
++ (MAX_SKB_FRAGS + 1);
++ linear = PAGE_SIZE - headroom;
++ }
+ }
+ skb = sock_alloc_send_pskb(sk, headroom + linear, len - linear,
+ noblock, &err, 0);
--- /dev/null
+From 5e44fca5047054f1762813751626b5245e0da022 Mon Sep 17 00:00:00 2001
+From: Daniel Jurgens <danielj@mellanox.com>
+Date: Tue, 10 Jan 2017 22:33:39 +0200
+Subject: net/mlx5: Only cancel recovery work when cleaning up device
+
+From: Daniel Jurgens <danielj@mellanox.com>
+
+commit 5e44fca5047054f1762813751626b5245e0da022 upstream.
+
+Do not attempt to drain the health workqueue when unloading the device in
+the recovery flow, this can cause a deadlock when the recovery work
+tries to cancel itself with sync.
+
+Because the work is no longer unconditionally canceled when unloading, it
+must be explicitly canceled in the AER flow.
+
+fixes: 689a248df83b ("net/mlx5: Cancel recovery work in remove flow")
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1158,7 +1158,8 @@ static int mlx5_unload_one(struct mlx5_c
+ {
+ int err = 0;
+
+- mlx5_drain_health_wq(dev);
++ if (cleanup)
++ mlx5_drain_health_wq(dev);
+
+ mutex_lock(&dev->intf_state_mutex);
+ if (test_bit(MLX5_INTERFACE_STATE_DOWN, &dev->intf_state)) {
+@@ -1320,9 +1321,10 @@ static pci_ers_result_t mlx5_pci_err_det
+
+ mlx5_enter_error_state(dev);
+ mlx5_unload_one(dev, priv, false);
+- /* In case of kernel call save the pci state */
++ /* In case of kernel call save the pci state and drain the health wq */
+ if (state) {
+ pci_save_state(pdev);
++ mlx5_drain_health_wq(dev);
+ mlx5_pci_disable_device(dev);
+ }
+
--- /dev/null
+From 79f687a3de9e3ba2518b4ea33f38ca6cbe9133eb Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Sat, 19 Nov 2016 10:54:55 -0500
+Subject: NFS: Fix a performance regression in readdir
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit 79f687a3de9e3ba2518b4ea33f38ca6cbe9133eb upstream.
+
+Ben Coddington reports that commit 311324ad1713, by adding the function
+nfs_dir_mapping_need_revalidate() that checks page cache validity on
+each call to nfs_readdir() causes a performance regression when
+the directory is being modified.
+
+If the directory is changing while we're iterating through the directory,
+POSIX does not require us to invalidate the page cache unless the user
+calls rewinddir(). However, we still do want to ensure that we use
+readdirplus in order to avoid a load of stat() calls when the user
+is doing an 'ls -l' workload.
+
+The fix should be to invalidate the page cache immediately when we're
+setting the NFS_INO_ADVISE_RDPLUS bit.
+
+Reported-by: Benjamin Coddington <bcodding@redhat.com>
+Fixes: 311324ad1713 ("NFS: Be more aggressive in using readdirplus...")
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Tested-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/dir.c | 15 ++-------------
+ 1 file changed, 2 insertions(+), 13 deletions(-)
+
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -477,7 +477,7 @@ void nfs_force_use_readdirplus(struct in
+ {
+ if (!list_empty(&NFS_I(dir)->open_files)) {
+ nfs_advise_use_readdirplus(dir);
+- nfs_zap_mapping(dir, dir->i_mapping);
++ invalidate_mapping_pages(dir->i_mapping, 0, -1);
+ }
+ }
+
+@@ -886,17 +886,6 @@ int uncached_readdir(nfs_readdir_descrip
+ goto out;
+ }
+
+-static bool nfs_dir_mapping_need_revalidate(struct inode *dir)
+-{
+- struct nfs_inode *nfsi = NFS_I(dir);
+-
+- if (nfs_attribute_cache_expired(dir))
+- return true;
+- if (nfsi->cache_validity & NFS_INO_INVALID_DATA)
+- return true;
+- return false;
+-}
+-
+ /* The file offset position represents the dirent entry number. A
+ last cookie cache takes care of the common case of reading the
+ whole directory.
+@@ -928,7 +917,7 @@ static int nfs_readdir(struct file *file
+ desc->decode = NFS_PROTO(inode)->decode_dirent;
+ desc->plus = nfs_use_readdirplus(inode, ctx) ? 1 : 0;
+
+- if (ctx->pos == 0 || nfs_dir_mapping_need_revalidate(inode))
++ if (ctx->pos == 0 || nfs_attribute_cache_expired(inode))
+ res = nfs_revalidate_mapping(inode, file->f_mapping);
+ if (res < 0)
+ goto out;
--- /dev/null
+From f36ab161bebe464d33b998294eff29b17a9c8918 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Fri, 28 Oct 2016 14:37:02 +0000
+Subject: NFS: fix typo in parameter description
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit f36ab161bebe464d33b998294eff29b17a9c8918 upstream.
+
+Fix typo in parameter description.
+
+Fixes: 5405fc44c337 ("NFSv4.x: Add kernel parameter to control the
+callback server")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2904,7 +2904,7 @@ module_param(max_session_slots, ushort,
+ MODULE_PARM_DESC(max_session_slots, "Maximum number of outstanding NFSv4.1 "
+ "requests the client will negotiate");
+ module_param(max_session_cb_slots, ushort, 0644);
+-MODULE_PARM_DESC(max_session_slots, "Maximum number of parallel NFSv4.1 "
++MODULE_PARM_DESC(max_session_cb_slots, "Maximum number of parallel NFSv4.1 "
+ "callbacks the client will process for a given server");
+ module_param(send_implementation_id, ushort, 0644);
+ MODULE_PARM_DESC(send_implementation_id,
--- /dev/null
+From cfd278c280f997cf2fe4662e0acab0fe465f637b Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Mon, 19 Dec 2016 11:19:31 +1100
+Subject: NFSv4.1: nfs4_fl_prepare_ds must be careful about reporting success.
+
+From: NeilBrown <neilb@suse.com>
+
+commit cfd278c280f997cf2fe4662e0acab0fe465f637b upstream.
+
+Various places assume that if nfs4_fl_prepare_ds() turns a non-NULL 'ds',
+then ds->ds_clp will also be non-NULL.
+
+This is not necessasrily true in the case when the process received a fatal signal
+while nfs4_pnfs_ds_connect is waiting in nfs4_wait_ds_connect().
+In that case ->ds_clp may not be set, and the devid may not recently have been marked
+unavailable.
+
+So add a test for ds_clp == NULL and return NULL in that case.
+
+Fixes: c23266d532b4 ("NFS4.1 Fix data server connection race")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Acked-by: Olga Kornievskaia <aglo@umich.edu>
+Acked-by: Adamson, Andy <William.Adamson@netapp.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/filelayout/filelayoutdev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfs/filelayout/filelayoutdev.c
++++ b/fs/nfs/filelayout/filelayoutdev.c
+@@ -283,7 +283,8 @@ nfs4_fl_prepare_ds(struct pnfs_layout_se
+ s->nfs_client->cl_rpcclient->cl_auth->au_flavor);
+
+ out_test_devid:
+- if (filelayout_test_devid_unavailable(devid))
++ if (ret->ds_clp == NULL ||
++ filelayout_test_devid_unavailable(devid))
+ ret = NULL;
+ out:
+ return ret;
--- /dev/null
+From b5a10c5f7532b7473776da87e67f8301bbc32693 Mon Sep 17 00:00:00 2001
+From: "Guilherme G. Piccoli" <gpiccoli@linux.vnet.ibm.com>
+Date: Wed, 28 Dec 2016 22:13:15 -0200
+Subject: nvme: apply DELAY_BEFORE_CHK_RDY quirk at probe time too
+
+From: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
+
+commit b5a10c5f7532b7473776da87e67f8301bbc32693 upstream.
+
+Commit 54adc01055b7 ("nvme/quirk: Add a delay before checking for adapter
+readiness") introduced a quirk to adapters that cannot read the bit
+NVME_CSTS_RDY right after register NVME_REG_CC is set; these adapters
+need a delay or else the action of reading the bit NVME_CSTS_RDY could
+somehow corrupt adapter's registers state and it never recovers.
+
+When this quirk was added, we checked ctrl->tagset in order to avoid
+quirking in probe time, supposing we would never require such delay
+during probe. Well, it was too optimistic; we in fact need this quirk
+at probe time in some cases, like after a kexec.
+
+In some experiments, after abnormal shutdown of machine (aka power cord
+unplug), we booted into our bootloader in Power, which is a Linux kernel,
+and kexec'ed into another distro. If this kexec is too quick, we end up
+reaching the probe of NVMe adapter in that distro when adapter is in
+bad state (not fully initialized on our bootloader). What happens next
+is that nvme_wait_ready() is unable to complete, except if the quirk is
+enabled.
+
+So, this patch removes the original ctrl->tagset verification in order
+to enable the quirk even on probe time.
+
+Fixes: 54adc01055b7 ("nvme/quirk: Add a delay before checking for adapter readiness")
+Reported-by: Andrew Byrne <byrneadw@ie.ibm.com>
+Reported-by: Jaime A. H. Gomez <jahgomez@mx1.ibm.com>
+Reported-by: Zachary D. Myers <zdmyers@us.ibm.com>
+Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
+Acked-by: Jeffrey Lien <Jeff.Lien@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/host/core.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1122,12 +1122,7 @@ int nvme_disable_ctrl(struct nvme_ctrl *
+ if (ret)
+ return ret;
+
+- /* Checking for ctrl->tagset is a trick to avoid sleeping on module
+- * load, since we only need the quirk on reset_controller. Notice
+- * that the HGST device needs this delay only in firmware activation
+- * procedure; unfortunately we have no (easy) way to verify this.
+- */
+- if ((ctrl->quirks & NVME_QUIRK_DELAY_BEFORE_CHK_RDY) && ctrl->tagset)
++ if (ctrl->quirks & NVME_QUIRK_DELAY_BEFORE_CHK_RDY)
+ msleep(NVME_QUIRK_DELAY_AMOUNT);
+
+ return nvme_wait_ready(ctrl, cap, false);
--- /dev/null
+From 570b90fa230b8021f51a67fab2245fe8df6fe37d Mon Sep 17 00:00:00 2001
+From: Andrew Lutomirski <luto@kernel.org>
+Date: Mon, 12 Dec 2016 12:55:55 -0800
+Subject: orinoco: Use shash instead of ahash for MIC calculations
+
+From: Andrew Lutomirski <luto@kernel.org>
+
+commit 570b90fa230b8021f51a67fab2245fe8df6fe37d upstream.
+
+Eric Biggers pointed out that the orinoco driver pointed scatterlists
+at the stack.
+
+Fix it by switching from ahash to shash. The result should be
+simpler, faster, and more correct.
+
+kvalo: cherry picked from commit 1fef293b8a9850cfa124a53c1d8878d355010403 as I
+accidentally applied this patch to wireless-drivers-next when I was supposed to
+apply this wireless-drivers
+
+Reported-by: Eric Biggers <ebiggers3@gmail.com>
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intersil/orinoco/mic.c | 44 ++++++++++++++----------
+ drivers/net/wireless/intersil/orinoco/mic.h | 3 +
+ drivers/net/wireless/intersil/orinoco/orinoco.h | 4 +-
+ 3 files changed, 30 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/intersil/orinoco/mic.c
++++ b/drivers/net/wireless/intersil/orinoco/mic.c
+@@ -16,7 +16,7 @@
+ /********************************************************************/
+ int orinoco_mic_init(struct orinoco_private *priv)
+ {
+- priv->tx_tfm_mic = crypto_alloc_ahash("michael_mic", 0,
++ priv->tx_tfm_mic = crypto_alloc_shash("michael_mic", 0,
+ CRYPTO_ALG_ASYNC);
+ if (IS_ERR(priv->tx_tfm_mic)) {
+ printk(KERN_DEBUG "orinoco_mic_init: could not allocate "
+@@ -25,7 +25,7 @@ int orinoco_mic_init(struct orinoco_priv
+ return -ENOMEM;
+ }
+
+- priv->rx_tfm_mic = crypto_alloc_ahash("michael_mic", 0,
++ priv->rx_tfm_mic = crypto_alloc_shash("michael_mic", 0,
+ CRYPTO_ALG_ASYNC);
+ if (IS_ERR(priv->rx_tfm_mic)) {
+ printk(KERN_DEBUG "orinoco_mic_init: could not allocate "
+@@ -40,17 +40,16 @@ int orinoco_mic_init(struct orinoco_priv
+ void orinoco_mic_free(struct orinoco_private *priv)
+ {
+ if (priv->tx_tfm_mic)
+- crypto_free_ahash(priv->tx_tfm_mic);
++ crypto_free_shash(priv->tx_tfm_mic);
+ if (priv->rx_tfm_mic)
+- crypto_free_ahash(priv->rx_tfm_mic);
++ crypto_free_shash(priv->rx_tfm_mic);
+ }
+
+-int orinoco_mic(struct crypto_ahash *tfm_michael, u8 *key,
++int orinoco_mic(struct crypto_shash *tfm_michael, u8 *key,
+ u8 *da, u8 *sa, u8 priority,
+ u8 *data, size_t data_len, u8 *mic)
+ {
+- AHASH_REQUEST_ON_STACK(req, tfm_michael);
+- struct scatterlist sg[2];
++ SHASH_DESC_ON_STACK(desc, tfm_michael);
+ u8 hdr[ETH_HLEN + 2]; /* size of header + padding */
+ int err;
+
+@@ -67,18 +66,27 @@ int orinoco_mic(struct crypto_ahash *tfm
+ hdr[ETH_ALEN * 2 + 2] = 0;
+ hdr[ETH_ALEN * 2 + 3] = 0;
+
+- /* Use scatter gather to MIC header and data in one go */
+- sg_init_table(sg, 2);
+- sg_set_buf(&sg[0], hdr, sizeof(hdr));
+- sg_set_buf(&sg[1], data, data_len);
++ desc->tfm = tfm_michael;
++ desc->flags = 0;
+
+- if (crypto_ahash_setkey(tfm_michael, key, MIC_KEYLEN))
+- return -1;
++ err = crypto_shash_setkey(tfm_michael, key, MIC_KEYLEN);
++ if (err)
++ return err;
++
++ err = crypto_shash_init(desc);
++ if (err)
++ return err;
++
++ err = crypto_shash_update(desc, hdr, sizeof(hdr));
++ if (err)
++ return err;
++
++ err = crypto_shash_update(desc, data, data_len);
++ if (err)
++ return err;
++
++ err = crypto_shash_final(desc, mic);
++ shash_desc_zero(desc);
+
+- ahash_request_set_tfm(req, tfm_michael);
+- ahash_request_set_callback(req, 0, NULL, NULL);
+- ahash_request_set_crypt(req, sg, mic, data_len + sizeof(hdr));
+- err = crypto_ahash_digest(req);
+- ahash_request_zero(req);
+ return err;
+ }
+--- a/drivers/net/wireless/intersil/orinoco/mic.h
++++ b/drivers/net/wireless/intersil/orinoco/mic.h
+@@ -6,6 +6,7 @@
+ #define _ORINOCO_MIC_H_
+
+ #include <linux/types.h>
++#include <crypto/hash.h>
+
+ #define MICHAEL_MIC_LEN 8
+
+@@ -15,7 +16,7 @@ struct crypto_ahash;
+
+ int orinoco_mic_init(struct orinoco_private *priv);
+ void orinoco_mic_free(struct orinoco_private *priv);
+-int orinoco_mic(struct crypto_ahash *tfm_michael, u8 *key,
++int orinoco_mic(struct crypto_shash *tfm_michael, u8 *key,
+ u8 *da, u8 *sa, u8 priority,
+ u8 *data, size_t data_len, u8 *mic);
+
+--- a/drivers/net/wireless/intersil/orinoco/orinoco.h
++++ b/drivers/net/wireless/intersil/orinoco/orinoco.h
+@@ -152,8 +152,8 @@ struct orinoco_private {
+ u8 *wpa_ie;
+ int wpa_ie_len;
+
+- struct crypto_ahash *rx_tfm_mic;
+- struct crypto_ahash *tx_tfm_mic;
++ struct crypto_shash *rx_tfm_mic;
++ struct crypto_shash *tx_tfm_mic;
+
+ unsigned int wpa_enabled:1;
+ unsigned int tkip_cm_active:1;
--- /dev/null
+From f24d311f92b516a8aadef5056424ccabb4068e7b Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Tue, 6 Dec 2016 15:08:16 +0100
+Subject: pinctrl: meson: fix gpio request disabling other modes
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+commit f24d311f92b516a8aadef5056424ccabb4068e7b upstream.
+
+The pinctrl_gpio_request is called with the "full" gpio number, already
+containing the base, then meson_pmx_request_gpio is then called with the
+final pin number.
+Remove the base addition when calling meson_pmx_disable_other_groups.
+
+Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs")
+CC: Beniamino Galvani <b.galvani@gmail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Acked-by: Kevin Hilman <khilman@baylibre.com>
+Acked-by: Beniamino Galvani <b.galvani@gmail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/meson/pinctrl-meson.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/meson/pinctrl-meson.c
++++ b/drivers/pinctrl/meson/pinctrl-meson.c
+@@ -212,7 +212,7 @@ static int meson_pmx_request_gpio(struct
+ {
+ struct meson_pinctrl *pc = pinctrl_dev_get_drvdata(pcdev);
+
+- meson_pmx_disable_other_groups(pc, range->pin_base + offset, -1);
++ meson_pmx_disable_other_groups(pc, offset, -1);
+
+ return 0;
+ }
--- /dev/null
+From ee284e35d8c71bf5d4d807eaff6f67a17134b359 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Fri, 18 Nov 2016 15:21:30 -0500
+Subject: pNFS: Fix race in pnfs_wait_on_layoutreturn
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit ee284e35d8c71bf5d4d807eaff6f67a17134b359 upstream.
+
+We must put the task to sleep while holding the inode->i_lock in order
+to ensure atomicity with the test for NFS_LAYOUT_RETURN.
+
+Fixes: 500d701f336b ("NFS41: make close wait for layoutreturn")
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/pnfs.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1257,13 +1257,11 @@ bool pnfs_wait_on_layoutreturn(struct in
+ * i_lock */
+ spin_lock(&ino->i_lock);
+ lo = nfsi->layout;
+- if (lo && test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
++ if (lo && test_bit(NFS_LAYOUT_RETURN, &lo->plh_flags)) {
++ rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
+ sleep = true;
++ }
+ spin_unlock(&ino->i_lock);
+-
+- if (sleep)
+- rpc_sleep_on(&NFS_SERVER(ino)->roc_rpcwaitq, task, NULL);
+-
+ return sleep;
+ }
+
--- /dev/null
+From 3bee9ea1de687925d116670f036599cbed8b66b0 Mon Sep 17 00:00:00 2001
+From: "Andrew F. Davis" <afd@ti.com>
+Date: Fri, 4 Nov 2016 13:33:13 -0500
+Subject: power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520
+
+From: Andrew F. Davis <afd@ti.com>
+
+commit 3bee9ea1de687925d116670f036599cbed8b66b0 upstream.
+
+The BQ27510 and BQ27520 use a slightly different register map than the
+BQ27500, add a new type enum and add these gauges to it.
+
+Fixes: d74534c27775 ("power: bq27xxx_battery: Add support for additional bq27xxx family devices")
+Based-on-patch-by: Kenneth R. Crudup <kenny@panix.com>
+Signed-off-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/supply/bq27xxx_battery.c | 41 ++++++++++++++++++++++++++++-
+ drivers/power/supply/bq27xxx_battery_i2c.c | 4 +-
+ include/linux/power/bq27xxx_battery.h | 3 +-
+ 3 files changed, 44 insertions(+), 4 deletions(-)
+
+--- a/drivers/power/supply/bq27xxx_battery.c
++++ b/drivers/power/supply/bq27xxx_battery.c
+@@ -164,6 +164,25 @@ static u8 bq27xxx_regs[][BQ27XXX_REG_MAX
+ [BQ27XXX_REG_DCAP] = 0x3c,
+ [BQ27XXX_REG_AP] = INVALID_REG_ADDR,
+ },
++ [BQ27510] = {
++ [BQ27XXX_REG_CTRL] = 0x00,
++ [BQ27XXX_REG_TEMP] = 0x06,
++ [BQ27XXX_REG_INT_TEMP] = 0x28,
++ [BQ27XXX_REG_VOLT] = 0x08,
++ [BQ27XXX_REG_AI] = 0x14,
++ [BQ27XXX_REG_FLAGS] = 0x0a,
++ [BQ27XXX_REG_TTE] = 0x16,
++ [BQ27XXX_REG_TTF] = INVALID_REG_ADDR,
++ [BQ27XXX_REG_TTES] = 0x1a,
++ [BQ27XXX_REG_TTECP] = INVALID_REG_ADDR,
++ [BQ27XXX_REG_NAC] = 0x0c,
++ [BQ27XXX_REG_FCC] = 0x12,
++ [BQ27XXX_REG_CYCT] = 0x1e,
++ [BQ27XXX_REG_AE] = INVALID_REG_ADDR,
++ [BQ27XXX_REG_SOC] = 0x20,
++ [BQ27XXX_REG_DCAP] = 0x2e,
++ [BQ27XXX_REG_AP] = INVALID_REG_ADDR,
++ },
+ [BQ27530] = {
+ [BQ27XXX_REG_CTRL] = 0x00,
+ [BQ27XXX_REG_TEMP] = 0x06,
+@@ -302,6 +321,24 @@ static enum power_supply_property bq2750
+ POWER_SUPPLY_PROP_MANUFACTURER,
+ };
+
++static enum power_supply_property bq27510_battery_props[] = {
++ POWER_SUPPLY_PROP_STATUS,
++ POWER_SUPPLY_PROP_PRESENT,
++ POWER_SUPPLY_PROP_VOLTAGE_NOW,
++ POWER_SUPPLY_PROP_CURRENT_NOW,
++ POWER_SUPPLY_PROP_CAPACITY,
++ POWER_SUPPLY_PROP_CAPACITY_LEVEL,
++ POWER_SUPPLY_PROP_TEMP,
++ POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW,
++ POWER_SUPPLY_PROP_TECHNOLOGY,
++ POWER_SUPPLY_PROP_CHARGE_FULL,
++ POWER_SUPPLY_PROP_CHARGE_NOW,
++ POWER_SUPPLY_PROP_CHARGE_FULL_DESIGN,
++ POWER_SUPPLY_PROP_CYCLE_COUNT,
++ POWER_SUPPLY_PROP_HEALTH,
++ POWER_SUPPLY_PROP_MANUFACTURER,
++};
++
+ static enum power_supply_property bq27530_battery_props[] = {
+ POWER_SUPPLY_PROP_STATUS,
+ POWER_SUPPLY_PROP_PRESENT,
+@@ -385,6 +422,7 @@ static struct {
+ BQ27XXX_PROP(BQ27000, bq27000_battery_props),
+ BQ27XXX_PROP(BQ27010, bq27010_battery_props),
+ BQ27XXX_PROP(BQ27500, bq27500_battery_props),
++ BQ27XXX_PROP(BQ27510, bq27510_battery_props),
+ BQ27XXX_PROP(BQ27530, bq27530_battery_props),
+ BQ27XXX_PROP(BQ27541, bq27541_battery_props),
+ BQ27XXX_PROP(BQ27545, bq27545_battery_props),
+@@ -635,7 +673,8 @@ static int bq27xxx_battery_read_pwr_avg(
+ */
+ static bool bq27xxx_battery_overtemp(struct bq27xxx_device_info *di, u16 flags)
+ {
+- if (di->chip == BQ27500 || di->chip == BQ27541 || di->chip == BQ27545)
++ if (di->chip == BQ27500 || di->chip == BQ27510 ||
++ di->chip == BQ27541 || di->chip == BQ27545)
+ return flags & (BQ27XXX_FLAG_OTC | BQ27XXX_FLAG_OTD);
+ if (di->chip == BQ27530 || di->chip == BQ27421)
+ return flags & BQ27XXX_FLAG_OT;
+--- a/drivers/power/supply/bq27xxx_battery_i2c.c
++++ b/drivers/power/supply/bq27xxx_battery_i2c.c
+@@ -149,8 +149,8 @@ static const struct i2c_device_id bq27xx
+ { "bq27200", BQ27000 },
+ { "bq27210", BQ27010 },
+ { "bq27500", BQ27500 },
+- { "bq27510", BQ27500 },
+- { "bq27520", BQ27500 },
++ { "bq27510", BQ27510 },
++ { "bq27520", BQ27510 },
+ { "bq27530", BQ27530 },
+ { "bq27531", BQ27530 },
+ { "bq27541", BQ27541 },
+--- a/include/linux/power/bq27xxx_battery.h
++++ b/include/linux/power/bq27xxx_battery.h
+@@ -4,7 +4,8 @@
+ enum bq27xxx_chip {
+ BQ27000 = 1, /* bq27000, bq27200 */
+ BQ27010, /* bq27010, bq27210 */
+- BQ27500, /* bq27500, bq27510, bq27520 */
++ BQ27500, /* bq27500 */
++ BQ27510, /* bq27510, bq27520 */
+ BQ27530, /* bq27530, bq27531 */
+ BQ27541, /* bq27541, bq27542, bq27546, bq27742 */
+ BQ27545, /* bq27545 */
--- /dev/null
+From cb43f81b8489dcb87555e16c17453f0a9fa690f2 Mon Sep 17 00:00:00 2001
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Date: Mon, 28 Nov 2016 13:53:11 -0800
+Subject: powercap/intel_rapl: fix and tidy up error handling
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+commit cb43f81b8489dcb87555e16c17453f0a9fa690f2 upstream.
+
+Commit e1399ba20eee ("powercap / RAPL: handle missing MSRs") added
+contraint_to_pl() function to return index into an array. But it
+can potentially return -EINVAL if powercap layer sends an out of
+range constraint ID. This patch adds sanity check.
+
+Unnecessary RAPL domain pointer check is removed since it must be
+initialized before calling rapl_unit_xlate().
+
+Fixes: e1399ba20eee ("powercap / RAPL: handle missing MSRs")
+Reported-by: Odzioba, Lukasz <lukasz.odzioba@intel.com>
+Reported-by: Koss, Marcin <marcin.koss@intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/powercap/intel_rapl.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+--- a/drivers/powercap/intel_rapl.c
++++ b/drivers/powercap/intel_rapl.c
+@@ -442,6 +442,7 @@ static int contraint_to_pl(struct rapl_d
+ return i;
+ }
+ }
++ pr_err("Cannot find matching power limit for constraint %d\n", cid);
+
+ return -EINVAL;
+ }
+@@ -457,6 +458,10 @@ static int set_power_limit(struct powerc
+ get_online_cpus();
+ rd = power_zone_to_rapl_domain(power_zone);
+ id = contraint_to_pl(rd, cid);
++ if (id < 0) {
++ ret = id;
++ goto set_exit;
++ }
+
+ rp = rd->rp;
+
+@@ -496,6 +501,11 @@ static int get_current_power_limit(struc
+ get_online_cpus();
+ rd = power_zone_to_rapl_domain(power_zone);
+ id = contraint_to_pl(rd, cid);
++ if (id < 0) {
++ ret = id;
++ goto get_exit;
++ }
++
+ switch (rd->rpl[id].prim_id) {
+ case PL1_ENABLE:
+ prim = POWER_LIMIT1;
+@@ -512,6 +522,7 @@ static int get_current_power_limit(struc
+ else
+ *data = val;
+
++get_exit:
+ put_online_cpus();
+
+ return ret;
+@@ -527,6 +538,10 @@ static int set_time_window(struct powerc
+ get_online_cpus();
+ rd = power_zone_to_rapl_domain(power_zone);
+ id = contraint_to_pl(rd, cid);
++ if (id < 0) {
++ ret = id;
++ goto set_time_exit;
++ }
+
+ switch (rd->rpl[id].prim_id) {
+ case PL1_ENABLE:
+@@ -538,6 +553,8 @@ static int set_time_window(struct powerc
+ default:
+ ret = -EINVAL;
+ }
++
++set_time_exit:
+ put_online_cpus();
+ return ret;
+ }
+@@ -552,6 +569,10 @@ static int get_time_window(struct powerc
+ get_online_cpus();
+ rd = power_zone_to_rapl_domain(power_zone);
+ id = contraint_to_pl(rd, cid);
++ if (id < 0) {
++ ret = id;
++ goto get_time_exit;
++ }
+
+ switch (rd->rpl[id].prim_id) {
+ case PL1_ENABLE:
+@@ -566,6 +587,8 @@ static int get_time_window(struct powerc
+ }
+ if (!ret)
+ *data = val;
++
++get_time_exit:
+ put_online_cpus();
+
+ return ret;
+@@ -707,7 +730,7 @@ static u64 rapl_unit_xlate(struct rapl_d
+ case ENERGY_UNIT:
+ scale = ENERGY_UNIT_SCALE;
+ /* per domain unit takes precedence */
+- if (rd && rd->domain_energy_unit)
++ if (rd->domain_energy_unit)
+ units = rd->domain_energy_unit;
+ else
+ units = rp->energy_unit;
--- /dev/null
+From 6b243fcfb5f1e16bcf732e6f86a63f8af5b59a9f Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Fri, 11 Nov 2016 16:55:03 +1100
+Subject: powerpc/64: Simplify adaptation to new ISA v3.00 HPTE format
+
+From: Paul Mackerras <paulus@ozlabs.org>
+
+commit 6b243fcfb5f1e16bcf732e6f86a63f8af5b59a9f upstream.
+
+This changes the way that we support the new ISA v3.00 HPTE format.
+Instead of adapting everything that uses HPTE values to handle either
+the old format or the new format, depending on which CPU we are on,
+we now convert explicitly between old and new formats if necessary
+in the low-level routines that actually access HPTEs in memory.
+This limits the amount of code that needs to know about the new
+format and makes the conversions explicit. This is OK because the
+old format contains all the information that is in the new format.
+
+This also fixes operation under a hypervisor, because the H_ENTER
+hypercall (and other hypercalls that deal with HPTEs) will continue
+to require the HPTE value to be supplied in the old format. At
+present the kernel will not boot in HPT mode on POWER9 under a
+hypervisor.
+
+This fixes and partially reverts commit 50de596de8be
+("powerpc/mm/hash: Add support for Power9 Hash", 2016-04-29).
+
+Fixes: 50de596de8be ("powerpc/mm/hash: Add support for Power9 Hash")
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/book3s/64/mmu-hash.h | 47 +++++++++++++++++++++-----
+ arch/powerpc/mm/hash_native_64.c | 30 +++++++++++++---
+ arch/powerpc/platforms/ps3/htab.c | 2 -
+ arch/powerpc/platforms/pseries/lpar.c | 2 -
+ 4 files changed, 65 insertions(+), 16 deletions(-)
+
+--- a/arch/powerpc/include/asm/book3s/64/mmu-hash.h
++++ b/arch/powerpc/include/asm/book3s/64/mmu-hash.h
+@@ -70,7 +70,9 @@
+
+ #define HPTE_V_SSIZE_SHIFT 62
+ #define HPTE_V_AVPN_SHIFT 7
++#define HPTE_V_COMMON_BITS ASM_CONST(0x000fffffffffffff)
+ #define HPTE_V_AVPN ASM_CONST(0x3fffffffffffff80)
++#define HPTE_V_AVPN_3_0 ASM_CONST(0x000fffffffffff80)
+ #define HPTE_V_AVPN_VAL(x) (((x) & HPTE_V_AVPN) >> HPTE_V_AVPN_SHIFT)
+ #define HPTE_V_COMPARE(x,y) (!(((x) ^ (y)) & 0xffffffffffffff80UL))
+ #define HPTE_V_BOLTED ASM_CONST(0x0000000000000010)
+@@ -80,14 +82,16 @@
+ #define HPTE_V_VALID ASM_CONST(0x0000000000000001)
+
+ /*
+- * ISA 3.0 have a different HPTE format.
++ * ISA 3.0 has a different HPTE format.
+ */
+ #define HPTE_R_3_0_SSIZE_SHIFT 58
++#define HPTE_R_3_0_SSIZE_MASK (3ull << HPTE_R_3_0_SSIZE_SHIFT)
+ #define HPTE_R_PP0 ASM_CONST(0x8000000000000000)
+ #define HPTE_R_TS ASM_CONST(0x4000000000000000)
+ #define HPTE_R_KEY_HI ASM_CONST(0x3000000000000000)
+ #define HPTE_R_RPN_SHIFT 12
+ #define HPTE_R_RPN ASM_CONST(0x0ffffffffffff000)
++#define HPTE_R_RPN_3_0 ASM_CONST(0x01fffffffffff000)
+ #define HPTE_R_PP ASM_CONST(0x0000000000000003)
+ #define HPTE_R_PPP ASM_CONST(0x8000000000000003)
+ #define HPTE_R_N ASM_CONST(0x0000000000000004)
+@@ -316,12 +320,43 @@ static inline unsigned long hpte_encode_
+ */
+ v = (vpn >> (23 - VPN_SHIFT)) & ~(mmu_psize_defs[psize].avpnm);
+ v <<= HPTE_V_AVPN_SHIFT;
+- if (!cpu_has_feature(CPU_FTR_ARCH_300))
+- v |= ((unsigned long) ssize) << HPTE_V_SSIZE_SHIFT;
++ v |= ((unsigned long) ssize) << HPTE_V_SSIZE_SHIFT;
+ return v;
+ }
+
+ /*
++ * ISA v3.0 defines a new HPTE format, which differs from the old
++ * format in having smaller AVPN and ARPN fields, and the B field
++ * in the second dword instead of the first.
++ */
++static inline unsigned long hpte_old_to_new_v(unsigned long v)
++{
++ /* trim AVPN, drop B */
++ return v & HPTE_V_COMMON_BITS;
++}
++
++static inline unsigned long hpte_old_to_new_r(unsigned long v, unsigned long r)
++{
++ /* move B field from 1st to 2nd dword, trim ARPN */
++ return (r & ~HPTE_R_3_0_SSIZE_MASK) |
++ (((v) >> HPTE_V_SSIZE_SHIFT) << HPTE_R_3_0_SSIZE_SHIFT);
++}
++
++static inline unsigned long hpte_new_to_old_v(unsigned long v, unsigned long r)
++{
++ /* insert B field */
++ return (v & HPTE_V_COMMON_BITS) |
++ ((r & HPTE_R_3_0_SSIZE_MASK) <<
++ (HPTE_V_SSIZE_SHIFT - HPTE_R_3_0_SSIZE_SHIFT));
++}
++
++static inline unsigned long hpte_new_to_old_r(unsigned long r)
++{
++ /* clear out B field */
++ return r & ~HPTE_R_3_0_SSIZE_MASK;
++}
++
++/*
+ * This function sets the AVPN and L fields of the HPTE appropriately
+ * using the base page size and actual page size.
+ */
+@@ -341,12 +376,8 @@ static inline unsigned long hpte_encode_
+ * aligned for the requested page size
+ */
+ static inline unsigned long hpte_encode_r(unsigned long pa, int base_psize,
+- int actual_psize, int ssize)
++ int actual_psize)
+ {
+-
+- if (cpu_has_feature(CPU_FTR_ARCH_300))
+- pa |= ((unsigned long) ssize) << HPTE_R_3_0_SSIZE_SHIFT;
+-
+ /* A 4K page needs no special encoding */
+ if (actual_psize == MMU_PAGE_4K)
+ return pa & HPTE_R_RPN;
+--- a/arch/powerpc/mm/hash_native_64.c
++++ b/arch/powerpc/mm/hash_native_64.c
+@@ -221,13 +221,18 @@ static long native_hpte_insert(unsigned
+ return -1;
+
+ hpte_v = hpte_encode_v(vpn, psize, apsize, ssize) | vflags | HPTE_V_VALID;
+- hpte_r = hpte_encode_r(pa, psize, apsize, ssize) | rflags;
++ hpte_r = hpte_encode_r(pa, psize, apsize) | rflags;
+
+ if (!(vflags & HPTE_V_BOLTED)) {
+ DBG_LOW(" i=%x hpte_v=%016lx, hpte_r=%016lx\n",
+ i, hpte_v, hpte_r);
+ }
+
++ if (cpu_has_feature(CPU_FTR_ARCH_300)) {
++ hpte_r = hpte_old_to_new_r(hpte_v, hpte_r);
++ hpte_v = hpte_old_to_new_v(hpte_v);
++ }
++
+ hptep->r = cpu_to_be64(hpte_r);
+ /* Guarantee the second dword is visible before the valid bit */
+ eieio();
+@@ -295,6 +300,8 @@ static long native_hpte_updatepp(unsigne
+ vpn, want_v & HPTE_V_AVPN, slot, newpp);
+
+ hpte_v = be64_to_cpu(hptep->v);
++ if (cpu_has_feature(CPU_FTR_ARCH_300))
++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r));
+ /*
+ * We need to invalidate the TLB always because hpte_remove doesn't do
+ * a tlb invalidate. If a hash bucket gets full, we "evict" a more/less
+@@ -309,6 +316,8 @@ static long native_hpte_updatepp(unsigne
+ native_lock_hpte(hptep);
+ /* recheck with locks held */
+ hpte_v = be64_to_cpu(hptep->v);
++ if (cpu_has_feature(CPU_FTR_ARCH_300))
++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r));
+ if (unlikely(!HPTE_V_COMPARE(hpte_v, want_v) ||
+ !(hpte_v & HPTE_V_VALID))) {
+ ret = -1;
+@@ -350,6 +359,8 @@ static long native_hpte_find(unsigned lo
+ for (i = 0; i < HPTES_PER_GROUP; i++) {
+ hptep = htab_address + slot;
+ hpte_v = be64_to_cpu(hptep->v);
++ if (cpu_has_feature(CPU_FTR_ARCH_300))
++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r));
+
+ if (HPTE_V_COMPARE(hpte_v, want_v) && (hpte_v & HPTE_V_VALID))
+ /* HPTE matches */
+@@ -409,6 +420,8 @@ static void native_hpte_invalidate(unsig
+ want_v = hpte_encode_avpn(vpn, bpsize, ssize);
+ native_lock_hpte(hptep);
+ hpte_v = be64_to_cpu(hptep->v);
++ if (cpu_has_feature(CPU_FTR_ARCH_300))
++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r));
+
+ /*
+ * We need to invalidate the TLB always because hpte_remove doesn't do
+@@ -467,6 +480,8 @@ static void native_hugepage_invalidate(u
+ want_v = hpte_encode_avpn(vpn, psize, ssize);
+ native_lock_hpte(hptep);
+ hpte_v = be64_to_cpu(hptep->v);
++ if (cpu_has_feature(CPU_FTR_ARCH_300))
++ hpte_v = hpte_new_to_old_v(hpte_v, be64_to_cpu(hptep->r));
+
+ /* Even if we miss, we need to invalidate the TLB */
+ if (!HPTE_V_COMPARE(hpte_v, want_v) || !(hpte_v & HPTE_V_VALID))
+@@ -504,6 +519,10 @@ static void hpte_decode(struct hash_pte
+ /* Look at the 8 bit LP value */
+ unsigned int lp = (hpte_r >> LP_SHIFT) & ((1 << LP_BITS) - 1);
+
++ if (cpu_has_feature(CPU_FTR_ARCH_300)) {
++ hpte_v = hpte_new_to_old_v(hpte_v, hpte_r);
++ hpte_r = hpte_new_to_old_r(hpte_r);
++ }
+ if (!(hpte_v & HPTE_V_LARGE)) {
+ size = MMU_PAGE_4K;
+ a_size = MMU_PAGE_4K;
+@@ -512,11 +531,7 @@ static void hpte_decode(struct hash_pte
+ a_size = hpte_page_sizes[lp] >> 4;
+ }
+ /* This works for all page sizes, and for 256M and 1T segments */
+- if (cpu_has_feature(CPU_FTR_ARCH_300))
+- *ssize = hpte_r >> HPTE_R_3_0_SSIZE_SHIFT;
+- else
+- *ssize = hpte_v >> HPTE_V_SSIZE_SHIFT;
+-
++ *ssize = hpte_v >> HPTE_V_SSIZE_SHIFT;
+ shift = mmu_psize_defs[size].shift;
+
+ avpn = (HPTE_V_AVPN_VAL(hpte_v) & ~mmu_psize_defs[size].avpnm);
+@@ -639,6 +654,9 @@ static void native_flush_hash_range(unsi
+ want_v = hpte_encode_avpn(vpn, psize, ssize);
+ native_lock_hpte(hptep);
+ hpte_v = be64_to_cpu(hptep->v);
++ if (cpu_has_feature(CPU_FTR_ARCH_300))
++ hpte_v = hpte_new_to_old_v(hpte_v,
++ be64_to_cpu(hptep->r));
+ if (!HPTE_V_COMPARE(hpte_v, want_v) ||
+ !(hpte_v & HPTE_V_VALID))
+ native_unlock_hpte(hptep);
+--- a/arch/powerpc/platforms/ps3/htab.c
++++ b/arch/powerpc/platforms/ps3/htab.c
+@@ -63,7 +63,7 @@ static long ps3_hpte_insert(unsigned lon
+ vflags &= ~HPTE_V_SECONDARY;
+
+ hpte_v = hpte_encode_v(vpn, psize, apsize, ssize) | vflags | HPTE_V_VALID;
+- hpte_r = hpte_encode_r(ps3_mm_phys_to_lpar(pa), psize, apsize, ssize) | rflags;
++ hpte_r = hpte_encode_r(ps3_mm_phys_to_lpar(pa), psize, apsize) | rflags;
+
+ spin_lock_irqsave(&ps3_htab_lock, flags);
+
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -145,7 +145,7 @@ static long pSeries_lpar_hpte_insert(uns
+ hpte_group, vpn, pa, rflags, vflags, psize);
+
+ hpte_v = hpte_encode_v(vpn, psize, apsize, ssize) | vflags | HPTE_V_VALID;
+- hpte_r = hpte_encode_r(pa, psize, apsize, ssize) | rflags;
++ hpte_r = hpte_encode_r(pa, psize, apsize) | rflags;
+
+ if (!(vflags & HPTE_V_BOLTED))
+ pr_devel(" hpte_v=%016lx, hpte_r=%016lx\n", hpte_v, hpte_r);
--- /dev/null
+From fe0f3168169f7c34c29b0cf0c489f126a7f29643 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 1 Nov 2016 16:26:00 +0100
+Subject: powerpc/ibmebus: Fix device reference leaks in sysfs interface
+
+From: Johan Hovold <johan@kernel.org>
+
+commit fe0f3168169f7c34c29b0cf0c489f126a7f29643 upstream.
+
+Make sure to drop any reference taken by bus_find_device() in the sysfs
+callbacks that are used to create and destroy devices based on
+device-tree entries.
+
+Fixes: 6bccf755ff53 ("[POWERPC] ibmebus: dynamic addition/removal of adapters, some code cleanup")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/ibmebus.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kernel/ibmebus.c
++++ b/arch/powerpc/kernel/ibmebus.c
+@@ -266,6 +266,7 @@ static ssize_t ibmebus_store_probe(struc
+ const char *buf, size_t count)
+ {
+ struct device_node *dn = NULL;
++ struct device *dev;
+ char *path;
+ ssize_t rc = 0;
+
+@@ -273,8 +274,10 @@ static ssize_t ibmebus_store_probe(struc
+ if (!path)
+ return -ENOMEM;
+
+- if (bus_find_device(&ibmebus_bus_type, NULL, path,
+- ibmebus_match_path)) {
++ dev = bus_find_device(&ibmebus_bus_type, NULL, path,
++ ibmebus_match_path);
++ if (dev) {
++ put_device(dev);
+ printk(KERN_WARNING "%s: %s has already been probed\n",
+ __func__, path);
+ rc = -EEXIST;
+@@ -311,6 +314,7 @@ static ssize_t ibmebus_store_remove(stru
+ if ((dev = bus_find_device(&ibmebus_bus_type, NULL, path,
+ ibmebus_match_path))) {
+ of_device_unregister(to_platform_device(dev));
++ put_device(dev);
+
+ kfree(path);
+ return count;
--- /dev/null
+From 815a7141c4d1b11610dccb7fcbb38633759824f2 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 1 Nov 2016 16:26:01 +0100
+Subject: powerpc/ibmebus: Fix further device reference leaks
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 815a7141c4d1b11610dccb7fcbb38633759824f2 upstream.
+
+Make sure to drop any reference taken by bus_find_device() when creating
+devices during init and driver registration.
+
+Fixes: 55347cc9962f ("[POWERPC] ibmebus: Add device creation and bus probing based on of_device")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/ibmebus.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kernel/ibmebus.c
++++ b/arch/powerpc/kernel/ibmebus.c
+@@ -180,6 +180,7 @@ static int ibmebus_create_device(struct
+ static int ibmebus_create_devices(const struct of_device_id *matches)
+ {
+ struct device_node *root, *child;
++ struct device *dev;
+ int ret = 0;
+
+ root = of_find_node_by_path("/");
+@@ -188,9 +189,12 @@ static int ibmebus_create_devices(const
+ if (!of_match_node(matches, child))
+ continue;
+
+- if (bus_find_device(&ibmebus_bus_type, NULL, child,
+- ibmebus_match_node))
++ dev = bus_find_device(&ibmebus_bus_type, NULL, child,
++ ibmebus_match_node);
++ if (dev) {
++ put_device(dev);
+ continue;
++ }
+
+ ret = ibmebus_create_device(child);
+ if (ret) {
--- /dev/null
+From 555c16328ae6d75a90e234eac9b51998d68f185b Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
+Date: Wed, 9 Nov 2016 16:36:33 +1100
+Subject: powerpc/mm: Correct process and partition table max size
+
+From: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
+
+commit 555c16328ae6d75a90e234eac9b51998d68f185b upstream.
+
+Version 3.00 of the ISA states that the PATS (partition table size) field
+of the PTCR (partition table control register) and the PRTS (process table
+size) field of the partition table entry must both be less than or equal
+to 24. However the actual size of the partition and process tables is equal
+to 2 to the power of 12 plus the PATS and PRTS fields, respectively. This
+means that the max allowable size of each of these tables is 2^36 or 64GB
+for both.
+
+Thus when checking the size shift for each we should be checking for values
+of greater than 36 instead of the current check for shifts larger than 24
+and 23.
+
+Fixes: 2bfd65e45e877fb5704730244da67c748d28a1b8
+Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
+Reviewed-by: Balbir Singh <bsingharora@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/mm/pgtable-radix.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -159,7 +159,7 @@ redo:
+ * Allocate Partition table and process table for the
+ * host.
+ */
+- BUILD_BUG_ON_MSG((PRTB_SIZE_SHIFT > 23), "Process table size too large.");
++ BUILD_BUG_ON_MSG((PRTB_SIZE_SHIFT > 36), "Process table size too large.");
+ process_tb = early_alloc_pgtable(1UL << PRTB_SIZE_SHIFT);
+ /*
+ * Fill in the process table.
+@@ -181,7 +181,7 @@ static void __init radix_init_partition_
+
+ rts_field = radix__get_tree_size();
+
+- BUILD_BUG_ON_MSG((PATB_SIZE_SHIFT > 24), "Partition table size too large.");
++ BUILD_BUG_ON_MSG((PATB_SIZE_SHIFT > 36), "Partition table size too large.");
+ partition_tb = early_alloc_pgtable(1UL << PATB_SIZE_SHIFT);
+ partition_tb->patb0 = cpu_to_be64(rts_field | __pa(init_mm.pgd) |
+ RADIX_PGD_INDEX_SIZE | PATB_HR);
--- /dev/null
+From d4791db527bf397c84c9956c3ece9692ed5322ac Mon Sep 17 00:00:00 2001
+From: Russell Currey <ruscur@russell.cc>
+Date: Wed, 16 Nov 2016 12:12:26 +1100
+Subject: powerpc/powernv: Don't warn on PE init if unfreeze is unsupported
+
+From: Russell Currey <ruscur@russell.cc>
+
+commit d4791db527bf397c84c9956c3ece9692ed5322ac upstream.
+
+Whenever a PE is initialised in powernv, opal_pci_eeh_freeze_clear() is
+called. This is to remove any existing freeze, and has no negative side
+effects if the PE is already in an unfrozen state. On PHB backends that
+don't support this operation and return OPAL_UNSUPPORTED, this creates a
+scary and misleading warning message.
+
+Skip the warning message on init if OPAL_UNSUPPORTED is returned.
+
+As far as I'm aware, this currently only affects NPUs.
+
+Fixes: 313483d ("powerpc/powernv: Unfreeze PE on allocation")
+Signed-off-by: Russell Currey <ruscur@russell.cc>
+Acked-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
+Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/powernv/pci-ioda.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -145,7 +145,7 @@ static struct pnv_ioda_pe *pnv_ioda_init
+ */
+ rc = opal_pci_eeh_freeze_clear(phb->opal_id, pe_no,
+ OPAL_EEH_ACTION_CLEAR_FREEZE_ALL);
+- if (rc != OPAL_SUCCESS)
++ if (rc != OPAL_SUCCESS && rc != OPAL_UNSUPPORTED)
+ pr_warn("%s: Error %lld unfreezing PHB#%d-PE#%d\n",
+ __func__, rc, phb->hose->global_number, pe_no);
+
--- /dev/null
+From 85b037442e3f0e84296ab1010fd6b057eee18496 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Thu, 10 Nov 2016 10:45:18 +0000
+Subject: regulators: helpers: Fix handling of bypass_val_on in get_bypass_regmap
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit 85b037442e3f0e84296ab1010fd6b057eee18496 upstream.
+
+The handling of bypass_val_on that was added in
+regulator_get_bypass_regmap is done unconditionally however
+several drivers don't define a value for bypass_val_on. This
+results in those drivers reporting bypass being enabled when
+it is not. In regulator_set_bypass_regmap we use bypass_mask
+if bypass_val_on is zero. This patch adds similar handling in
+regulator_get_bypass_regmap.
+
+Fixes: commit dd1a571daee7 ("regulator: helpers: Ensure bypass register field matches ON value")
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/helpers.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/regulator/helpers.c
++++ b/drivers/regulator/helpers.c
+@@ -454,13 +454,17 @@ EXPORT_SYMBOL_GPL(regulator_set_bypass_r
+ int regulator_get_bypass_regmap(struct regulator_dev *rdev, bool *enable)
+ {
+ unsigned int val;
++ unsigned int val_on = rdev->desc->bypass_val_on;
+ int ret;
+
+ ret = regmap_read(rdev->regmap, rdev->desc->bypass_reg, &val);
+ if (ret != 0)
+ return ret;
+
+- *enable = (val & rdev->desc->bypass_mask) == rdev->desc->bypass_val_on;
++ if (!val_on)
++ val_on = rdev->desc->bypass_mask;
++
++ *enable = (val & rdev->desc->bypass_mask) == val_on;
+
+ return 0;
+ }
--- /dev/null
+From 6de1a507c46bf22ed97043495b9ab96e4d5c213b Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Thu, 3 Nov 2016 19:37:25 -0700
+Subject: remoteproc: qcom_wcnss: Fix circular module dependency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+commit 6de1a507c46bf22ed97043495b9ab96e4d5c213b upstream.
+
+The tie between the main WCNSS driver and the IRIS driver causes a
+circular dependency between the two modules. Neither part makes sense to
+have on their own so lets merge them into one module.
+
+For the sake of picking up the clock and regulator resources described
+in the iris of_node we need an associated struct device. But, to keep
+the size of the patch down we continue to represent the IRIS part as its
+own platform_driver, within the same module, rather than setting up a
+dummy device.
+
+Fixes: aed361adca9f ("remoteproc: qcom: Introduce WCNSS peripheral image loader")
+Reported-by: Andreas Färber <afaerber@suse.de>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/remoteproc/Kconfig | 5 -----
+ drivers/remoteproc/Makefile | 5 +++--
+ drivers/remoteproc/qcom_wcnss.c | 25 +++++++++++++++++++++++--
+ drivers/remoteproc/qcom_wcnss.h | 2 ++
+ drivers/remoteproc/qcom_wcnss_iris.c | 8 +-------
+ 5 files changed, 29 insertions(+), 16 deletions(-)
+
+--- a/drivers/remoteproc/Kconfig
++++ b/drivers/remoteproc/Kconfig
+@@ -91,17 +91,12 @@ config QCOM_Q6V5_PIL
+ Say y here to support the Qualcomm Peripherial Image Loader for the
+ Hexagon V5 based remote processors.
+
+-config QCOM_WCNSS_IRIS
+- tristate
+- depends on OF && ARCH_QCOM
+-
+ config QCOM_WCNSS_PIL
+ tristate "Qualcomm WCNSS Peripheral Image Loader"
+ depends on OF && ARCH_QCOM
+ depends on QCOM_SMEM
+ select QCOM_MDT_LOADER
+ select QCOM_SCM
+- select QCOM_WCNSS_IRIS
+ select REMOTEPROC
+ help
+ Say y here to support the Peripheral Image Loader for the Qualcomm
+--- a/drivers/remoteproc/Makefile
++++ b/drivers/remoteproc/Makefile
+@@ -13,6 +13,7 @@ obj-$(CONFIG_WKUP_M3_RPROC) += wkup_m3_
+ obj-$(CONFIG_DA8XX_REMOTEPROC) += da8xx_remoteproc.o
+ obj-$(CONFIG_QCOM_MDT_LOADER) += qcom_mdt_loader.o
+ obj-$(CONFIG_QCOM_Q6V5_PIL) += qcom_q6v5_pil.o
+-obj-$(CONFIG_QCOM_WCNSS_IRIS) += qcom_wcnss_iris.o
+-obj-$(CONFIG_QCOM_WCNSS_PIL) += qcom_wcnss.o
++obj-$(CONFIG_QCOM_WCNSS_PIL) += qcom_wcnss_pil.o
++qcom_wcnss_pil-y += qcom_wcnss.o
++qcom_wcnss_pil-y += qcom_wcnss_iris.o
+ obj-$(CONFIG_ST_REMOTEPROC) += st_remoteproc.o
+--- a/drivers/remoteproc/qcom_wcnss.c
++++ b/drivers/remoteproc/qcom_wcnss.c
+@@ -143,7 +143,6 @@ void qcom_wcnss_assign_iris(struct qcom_
+
+ mutex_unlock(&wcnss->iris_lock);
+ }
+-EXPORT_SYMBOL_GPL(qcom_wcnss_assign_iris);
+
+ static int wcnss_load(struct rproc *rproc, const struct firmware *fw)
+ {
+@@ -619,6 +618,28 @@ static struct platform_driver wcnss_driv
+ },
+ };
+
+-module_platform_driver(wcnss_driver);
++static int __init wcnss_init(void)
++{
++ int ret;
++
++ ret = platform_driver_register(&wcnss_driver);
++ if (ret)
++ return ret;
++
++ ret = platform_driver_register(&qcom_iris_driver);
++ if (ret)
++ platform_driver_unregister(&wcnss_driver);
++
++ return ret;
++}
++module_init(wcnss_init);
++
++static void __exit wcnss_exit(void)
++{
++ platform_driver_unregister(&qcom_iris_driver);
++ platform_driver_unregister(&wcnss_driver);
++}
++module_exit(wcnss_exit);
++
+ MODULE_DESCRIPTION("Qualcomm Peripherial Image Loader for Wireless Subsystem");
+ MODULE_LICENSE("GPL v2");
+--- a/drivers/remoteproc/qcom_wcnss.h
++++ b/drivers/remoteproc/qcom_wcnss.h
+@@ -4,6 +4,8 @@
+ struct qcom_iris;
+ struct qcom_wcnss;
+
++extern struct platform_driver qcom_iris_driver;
++
+ struct wcnss_vreg_info {
+ const char * const name;
+ int min_voltage;
+--- a/drivers/remoteproc/qcom_wcnss_iris.c
++++ b/drivers/remoteproc/qcom_wcnss_iris.c
+@@ -94,14 +94,12 @@ disable_regulators:
+
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(qcom_iris_enable);
+
+ void qcom_iris_disable(struct qcom_iris *iris)
+ {
+ clk_disable_unprepare(iris->xo_clk);
+ regulator_bulk_disable(iris->num_vregs, iris->vregs);
+ }
+-EXPORT_SYMBOL_GPL(qcom_iris_disable);
+
+ static int qcom_iris_probe(struct platform_device *pdev)
+ {
+@@ -174,7 +172,7 @@ static const struct of_device_id iris_of
+ {}
+ };
+
+-static struct platform_driver wcnss_driver = {
++struct platform_driver qcom_iris_driver = {
+ .probe = qcom_iris_probe,
+ .remove = qcom_iris_remove,
+ .driver = {
+@@ -182,7 +180,3 @@ static struct platform_driver wcnss_driv
+ .of_match_table = iris_of_match,
+ },
+ };
+-
+-module_platform_driver(wcnss_driver);
+-MODULE_DESCRIPTION("Qualcomm Wireless Subsystem Iris driver");
+-MODULE_LICENSE("GPL v2");
--- /dev/null
+From 1d701d3dd8caf6660ff33c3c23a115b4649c5cdb Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Mon, 17 Oct 2016 16:23:35 +0000
+Subject: remoteproc: st: Fix error return code in st_rproc_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit 1d701d3dd8caf6660ff33c3c23a115b4649c5cdb upstream.
+
+Fix to return a negative error code from the st_rproc_state() error
+handling case instead of 0, as done elsewhere in this function.
+
+Fixes: 63edb0310a5c ("remoteproc: Supply controller driver for ST's Remote Processors")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/remoteproc/st_remoteproc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/remoteproc/st_remoteproc.c
++++ b/drivers/remoteproc/st_remoteproc.c
+@@ -245,8 +245,10 @@ static int st_rproc_probe(struct platfor
+ goto free_rproc;
+
+ enabled = st_rproc_state(pdev);
+- if (enabled < 0)
++ if (enabled < 0) {
++ ret = enabled;
+ goto free_rproc;
++ }
+
+ if (enabled) {
+ atomic_inc(&rproc->power);
pid-fix-lockdep-deadlock-warning-due-to-ucount_lock.patch
mnt-protect-the-mountpoint-hashtable-with-mount_lock.patch
drivers-char-mem-fix-thinkos-in-kmem-address-checks.patch
+dmaengine-omap-dma-fix-dynamic-lch_map-allocation.patch
+virtio_blk-avoid-dma-to-stack-for-the-sense-buffer.patch
+tty-serial-atmel-rs485-half-duplex-w-dma-enable-rx-after-tx-is-done.patch
+tty-serial-atmel_serial-bug-stop-dma-from-transmitting-in-stop_tx.patch
+ibmvscsis-fix-srp_transfer_data-fail-return-code.patch
+orinoco-use-shash-instead-of-ahash-for-mic-calculations.patch
+sysrq-attach-sysrq-handler-correctly-for-32-bit-kernel.patch
+extcon-return-error-code-on-failure.patch
+clearing-fifos-in-rs485-emulation-mode-causes-subsequent-transmits-to-break.patch
+sysctl-drop-reference-added-by-grab_header-in-proc_sys_readdir.patch
+net-af_iucv-don-t-use-paged-skbs-for-tx-on-hipersockets.patch
+drm-i915-gen9-fix-pcode-polling-timeout-in-stable-backport.patch
+drm-clean-up-planes-in-atomic-commit-helper-failure-path.patch
+drm-radeon-update-smc-firmware-selection-for-si.patch
+drm-radeon-drop-verde-dpm-quirks.patch
+drm-amdgpu-update-si-kicker-smc-firmware.patch
+drm-amdgpu-drop-verde-dpm-quirks.patch
+usb-serial-ch341-fix-modem-control-and-b0-handling.patch
+net-mlx5-only-cancel-recovery-work-when-cleaning-up-device.patch
+i2c-piix4-avoid-race-conditions-with-imc.patch
+x86-cpu-fix-bootup-crashes-by-sanitizing-the-argument-of-the-clearcpuid-command-line-option.patch
+nvme-apply-delay_before_chk_rdy-quirk-at-probe-time-too.patch
+btrfs-fix-locking-when-we-put-back-a-delayed-ref-that-s-too-new.patch
+btrfs-fix-error-handling-when-run_delayed_extent_op-fails.patch
+mm-fix-remote-numa-hits-statistics.patch
+pinctrl-meson-fix-gpio-request-disabling-other-modes.patch
+nfs-fix-typo-in-parameter-description.patch
+pnfs-fix-race-in-pnfs_wait_on_layoutreturn.patch
+nfs-fix-a-performance-regression-in-readdir.patch
+nfsv4.1-nfs4_fl_prepare_ds-must-be-careful-about-reporting-success.patch
+i2c-mux-pca954x-fix-i2c-mux-selection-caching.patch
+drm-i915-gen9-fix-pcode-polling-during-sagv-disabling.patch
+drm-avoid-uninitialized-timestamp-use-in-wait_vblank.patch
+drm-panel-simple-check-against-num_timings-when-setting-preferred-for-timing.patch
+drm-i915-move-the-min_pixclk-handling-to-the-end-of-readout.patch
+drm-initialise-drm_mm.head_node.allocated.patch
+remoteproc-qcom_wcnss-fix-circular-module-dependency.patch
+remoteproc-st-fix-error-return-code-in-st_rproc_probe.patch
+powerpc-64-simplify-adaptation-to-new-isa-v3.00-hpte-format.patch
+cpufreq-powernv-disable-preemption-while-checking-cpu-throttling-state.patch
+regulators-helpers-fix-handling-of-bypass_val_on-in-get_bypass_regmap.patch
+acpi-cppc-set-an-error-code-on-probe-error-path.patch
+block-change-extern-inline-to-static-inline.patch
+block-cfq_cpd_alloc-should-use-gfp.patch
+acpi-apei-fix-nmi-notification-handling.patch
+powercap-intel_rapl-fix-and-tidy-up-error-handling.patch
+iw_cxgb4-fix-error-return-code-in-c4iw_rdev_open.patch
+bq24190_charger-fix-pm-runtime-use-for-bq24190_battery_set_property.patch
+power-supply-bq27xxx_battery-fix-register-map-for-bq27510-and-bq27520.patch
+blk-mq-always-schedule-hctx-next_cpu.patch
+bus-vexpress-config-fix-device-reference-leak.patch
+powerpc-mm-correct-process-and-partition-table-max-size.patch
+powerpc-ibmebus-fix-further-device-reference-leaks.patch
+powerpc-ibmebus-fix-device-reference-leaks-in-sysfs-interface.patch
+powerpc-powernv-don-t-warn-on-pe-init-if-unfreeze-is-unsupported.patch
--- /dev/null
+From 93362fa47fe98b62e4a34ab408c4a418432e7939 Mon Sep 17 00:00:00 2001
+From: Zhou Chengming <zhouchengming1@huawei.com>
+Date: Fri, 6 Jan 2017 09:32:32 +0800
+Subject: sysctl: Drop reference added by grab_header in proc_sys_readdir
+
+From: Zhou Chengming <zhouchengming1@huawei.com>
+
+commit 93362fa47fe98b62e4a34ab408c4a418432e7939 upstream.
+
+Fixes CVE-2016-9191, proc_sys_readdir doesn't drop reference
+added by grab_header when return from !dir_emit_dots path.
+It can cause any path called unregister_sysctl_table will
+wait forever.
+
+The calltrace of CVE-2016-9191:
+
+[ 5535.960522] Call Trace:
+[ 5535.963265] [<ffffffff817cdaaf>] schedule+0x3f/0xa0
+[ 5535.968817] [<ffffffff817d33fb>] schedule_timeout+0x3db/0x6f0
+[ 5535.975346] [<ffffffff817cf055>] ? wait_for_completion+0x45/0x130
+[ 5535.982256] [<ffffffff817cf0d3>] wait_for_completion+0xc3/0x130
+[ 5535.988972] [<ffffffff810d1fd0>] ? wake_up_q+0x80/0x80
+[ 5535.994804] [<ffffffff8130de64>] drop_sysctl_table+0xc4/0xe0
+[ 5536.001227] [<ffffffff8130de17>] drop_sysctl_table+0x77/0xe0
+[ 5536.007648] [<ffffffff8130decd>] unregister_sysctl_table+0x4d/0xa0
+[ 5536.014654] [<ffffffff8130deff>] unregister_sysctl_table+0x7f/0xa0
+[ 5536.021657] [<ffffffff810f57f5>] unregister_sched_domain_sysctl+0x15/0x40
+[ 5536.029344] [<ffffffff810d7704>] partition_sched_domains+0x44/0x450
+[ 5536.036447] [<ffffffff817d0761>] ? __mutex_unlock_slowpath+0x111/0x1f0
+[ 5536.043844] [<ffffffff81167684>] rebuild_sched_domains_locked+0x64/0xb0
+[ 5536.051336] [<ffffffff8116789d>] update_flag+0x11d/0x210
+[ 5536.057373] [<ffffffff817cf61f>] ? mutex_lock_nested+0x2df/0x450
+[ 5536.064186] [<ffffffff81167acb>] ? cpuset_css_offline+0x1b/0x60
+[ 5536.070899] [<ffffffff810fce3d>] ? trace_hardirqs_on+0xd/0x10
+[ 5536.077420] [<ffffffff817cf61f>] ? mutex_lock_nested+0x2df/0x450
+[ 5536.084234] [<ffffffff8115a9f5>] ? css_killed_work_fn+0x25/0x220
+[ 5536.091049] [<ffffffff81167ae5>] cpuset_css_offline+0x35/0x60
+[ 5536.097571] [<ffffffff8115aa2c>] css_killed_work_fn+0x5c/0x220
+[ 5536.104207] [<ffffffff810bc83f>] process_one_work+0x1df/0x710
+[ 5536.110736] [<ffffffff810bc7c0>] ? process_one_work+0x160/0x710
+[ 5536.117461] [<ffffffff810bce9b>] worker_thread+0x12b/0x4a0
+[ 5536.123697] [<ffffffff810bcd70>] ? process_one_work+0x710/0x710
+[ 5536.130426] [<ffffffff810c3f7e>] kthread+0xfe/0x120
+[ 5536.135991] [<ffffffff817d4baf>] ret_from_fork+0x1f/0x40
+[ 5536.142041] [<ffffffff810c3e80>] ? kthread_create_on_node+0x230/0x230
+
+One cgroup maintainer mentioned that "cgroup is trying to offline
+a cpuset css, which takes place under cgroup_mutex. The offlining
+ends up trying to drain active usages of a sysctl table which apprently
+is not happening."
+The real reason is that proc_sys_readdir doesn't drop reference added
+by grab_header when return from !dir_emit_dots path. So this cpuset
+offline path will wait here forever.
+
+See here for details: http://www.openwall.com/lists/oss-security/2016/11/04/13
+
+Fixes: f0c3b5093add ("[readdir] convert procfs")
+Reported-by: CAI Qian <caiqian@redhat.com>
+Tested-by: Yang Shukui <yangshukui@huawei.com>
+Signed-off-by: Zhou Chengming <zhouchengming1@huawei.com>
+Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
+Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/proc/proc_sysctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -709,7 +709,7 @@ static int proc_sys_readdir(struct file
+ ctl_dir = container_of(head, struct ctl_dir, header);
+
+ if (!dir_emit_dots(file, ctx))
+- return 0;
++ goto out;
+
+ pos = 2;
+
+@@ -719,6 +719,7 @@ static int proc_sys_readdir(struct file
+ break;
+ }
+ }
++out:
+ sysctl_head_finish(head);
+ return 0;
+ }
--- /dev/null
+From 802c03881f29844af0252b6e22be5d2f65f93fd0 Mon Sep 17 00:00:00 2001
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Fri, 6 Jan 2017 02:14:16 +0900
+Subject: sysrq: attach sysrq handler correctly for 32-bit kernel
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+commit 802c03881f29844af0252b6e22be5d2f65f93fd0 upstream.
+
+The sysrq input handler should be attached to the input device which has
+a left alt key.
+
+On 32-bit kernels, some input devices which has a left alt key cannot
+attach sysrq handler. Because the keybit bitmap in struct input_device_id
+for sysrq is not correctly initialized. KEY_LEFTALT is 56 which is
+greater than BITS_PER_LONG on 32-bit kernels.
+
+I found this problem when using a matrix keypad device which defines
+a KEY_LEFTALT (56) but doesn't have a KEY_O (24 == 56%32).
+
+Cc: Jiri Slaby <jslaby@suse.com>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/sysrq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/sysrq.c
++++ b/drivers/tty/sysrq.c
+@@ -946,8 +946,8 @@ static const struct input_device_id sysr
+ {
+ .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+ INPUT_DEVICE_ID_MATCH_KEYBIT,
+- .evbit = { BIT_MASK(EV_KEY) },
+- .keybit = { BIT_MASK(KEY_LEFTALT) },
++ .evbit = { [BIT_WORD(EV_KEY)] = BIT_MASK(EV_KEY) },
++ .keybit = { [BIT_WORD(KEY_LEFTALT)] = BIT_MASK(KEY_LEFTALT) },
+ },
+ { },
+ };
--- /dev/null
+From b389f173aaa1204d6dc1f299082a162eb0491545 Mon Sep 17 00:00:00 2001
+From: Richard Genoud <richard.genoud@gmail.com>
+Date: Tue, 6 Dec 2016 13:05:33 +0100
+Subject: tty/serial: atmel: RS485 half duplex w/DMA: enable RX after TX is done
+
+From: Richard Genoud <richard.genoud@gmail.com>
+
+commit b389f173aaa1204d6dc1f299082a162eb0491545 upstream.
+
+When using RS485 in half duplex, RX should be enabled when TX is
+finished, and stopped when TX starts.
+
+Before commit 0058f0871efe7b01c6 ("tty/serial: atmel: fix RS485 half
+duplex with DMA"), RX was not disabled in atmel_start_tx() if the DMA
+was used. So, collisions could happened.
+
+But disabling RX in atmel_start_tx() uncovered another bug:
+RX was enabled again in the wrong place (in atmel_tx_dma) instead of
+being enabled when TX is finished (in atmel_complete_tx_dma), so the
+transmission simply stopped.
+
+This bug was not triggered before commit 0058f0871efe7b01c6
+("tty/serial: atmel: fix RS485 half duplex with DMA") because RX was
+never disabled before.
+
+Moving atmel_start_rx() in atmel_complete_tx_dma() corrects the problem.
+
+Reported-by: Gil Weber <webergil@gmail.com>
+Fixes: 0058f0871efe7b01c6
+Tested-by: Gil Weber <webergil@gmail.com>
+Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
+Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -798,6 +798,11 @@ static void atmel_complete_tx_dma(void *
+ */
+ if (!uart_circ_empty(xmit))
+ atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
++ else if ((port->rs485.flags & SER_RS485_ENABLED) &&
++ !(port->rs485.flags & SER_RS485_RX_DURING_TX)) {
++ /* DMA done, stop TX, start RX for RS485 */
++ atmel_start_rx(port);
++ }
+
+ spin_unlock_irqrestore(&port->lock, flags);
+ }
+@@ -900,12 +905,6 @@ static void atmel_tx_dma(struct uart_por
+ desc->callback = atmel_complete_tx_dma;
+ desc->callback_param = atmel_port;
+ atmel_port->cookie_tx = dmaengine_submit(desc);
+-
+- } else {
+- if (port->rs485.flags & SER_RS485_ENABLED) {
+- /* DMA done, stop TX, start RX for RS485 */
+- atmel_start_rx(port);
+- }
+ }
+
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
--- /dev/null
+From 89d8232411a85b9a6b12fd5da4d07d8a138a8e0c Mon Sep 17 00:00:00 2001
+From: Richard Genoud <richard.genoud@gmail.com>
+Date: Tue, 13 Dec 2016 17:27:56 +0100
+Subject: tty/serial: atmel_serial: BUG: stop DMA from transmitting in stop_tx
+
+From: Richard Genoud <richard.genoud@gmail.com>
+
+commit 89d8232411a85b9a6b12fd5da4d07d8a138a8e0c upstream.
+
+If we don't disable the transmitter in atmel_stop_tx, the DMA buffer
+continues to send data until it is emptied.
+This cause problems with the flow control (CTS is asserted and data are
+still sent).
+
+So, disabling the transmitter in atmel_stop_tx is a sane thing to do.
+
+Tested on at91sam9g35-cm(DMA)
+Tested for regressions on sama5d2-xplained(Fifo) and at91sam9g20ek(PDC)
+
+Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/atmel_serial.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -481,6 +481,14 @@ static void atmel_stop_tx(struct uart_po
+ /* disable PDC transmit */
+ atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS);
+ }
++
++ /*
++ * Disable the transmitter.
++ * This is mandatory when DMA is used, otherwise the DMA buffer
++ * is fully transmitted.
++ */
++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXDIS);
++
+ /* Disable interrupts */
+ atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask);
+
+@@ -513,6 +521,9 @@ static void atmel_start_tx(struct uart_p
+
+ /* Enable interrupts */
+ atmel_uart_writel(port, ATMEL_US_IER, atmel_port->tx_done_mask);
++
++ /* re-enable the transmitter */
++ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN);
+ }
+
+ /*
--- /dev/null
+From 030ee7ae52a46a2be52ccc8242c4a330aba8d38e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 6 Jan 2017 19:15:12 +0100
+Subject: USB: serial: ch341: fix modem-control and B0 handling
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 030ee7ae52a46a2be52ccc8242c4a330aba8d38e upstream.
+
+The modem-control signals are managed by the tty-layer during open and
+should not be asserted prematurely when set_termios is called from
+driver open.
+
+Also make sure that the signals are asserted only when changing speed
+from B0.
+
+Fixes: 664d5df92e88 ("USB: usb-serial ch341: support for DTR/RTS/CTS")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/ch341.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -362,24 +362,24 @@ static void ch341_set_termios(struct tty
+ baud_rate = tty_get_baud_rate(tty);
+
+ if (baud_rate) {
+- spin_lock_irqsave(&priv->lock, flags);
+- priv->line_control |= (CH341_BIT_DTR | CH341_BIT_RTS);
+- spin_unlock_irqrestore(&priv->lock, flags);
+ priv->baud_rate = baud_rate;
+ ch341_set_baudrate(port->serial->dev, priv);
+- } else {
+- spin_lock_irqsave(&priv->lock, flags);
+- priv->line_control &= ~(CH341_BIT_DTR | CH341_BIT_RTS);
+- spin_unlock_irqrestore(&priv->lock, flags);
+ }
+
+- ch341_set_handshake(port->serial->dev, priv->line_control);
+-
+ /* Unimplemented:
+ * (cflag & CSIZE) : data bits [5, 8]
+ * (cflag & PARENB) : parity {NONE, EVEN, ODD}
+ * (cflag & CSTOPB) : stop bits [1, 2]
+ */
++
++ spin_lock_irqsave(&priv->lock, flags);
++ if (C_BAUD(tty) == B0)
++ priv->line_control &= ~(CH341_BIT_DTR | CH341_BIT_RTS);
++ else if (old_termios && (old_termios->c_cflag & CBAUD) == B0)
++ priv->line_control |= (CH341_BIT_DTR | CH341_BIT_RTS);
++ spin_unlock_irqrestore(&priv->lock, flags);
++
++ ch341_set_handshake(port->serial->dev, priv->line_control);
+ }
+
+ static void ch341_break_ctl(struct tty_struct *tty, int break_state)
--- /dev/null
+From a14d749fcebe97ddf6af6db3d1f6ece85c9ddcb9 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Mon, 9 Jan 2017 08:56:23 -0700
+Subject: virtio_blk: avoid DMA to stack for the sense buffer
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit a14d749fcebe97ddf6af6db3d1f6ece85c9ddcb9 upstream.
+
+Most users of BLOCK_PC requests allocate the sense buffer on the stack,
+so to avoid DMA to the stack copy them to a field in the heap allocated
+virtblk_req structure. Without that any attempt at SCSI passthrough I/O,
+including the SG_IO ioctl from userspace will crash the kernel. Note that
+this includes running tools like hdparm even when the host does not have
+SCSI passthrough enabled.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/virtio_blk.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -56,6 +56,7 @@ struct virtblk_req {
+ struct virtio_blk_outhdr out_hdr;
+ struct virtio_scsi_inhdr in_hdr;
+ u8 status;
++ u8 sense[SCSI_SENSE_BUFFERSIZE];
+ struct scatterlist sg[];
+ };
+
+@@ -102,7 +103,8 @@ static int __virtblk_add_req(struct virt
+ }
+
+ if (type == cpu_to_virtio32(vq->vdev, VIRTIO_BLK_T_SCSI_CMD)) {
+- sg_init_one(&sense, vbr->req->sense, SCSI_SENSE_BUFFERSIZE);
++ memcpy(vbr->sense, vbr->req->sense, SCSI_SENSE_BUFFERSIZE);
++ sg_init_one(&sense, vbr->sense, SCSI_SENSE_BUFFERSIZE);
+ sgs[num_out + num_in++] = &sense;
+ sg_init_one(&inhdr, &vbr->in_hdr, sizeof(vbr->in_hdr));
+ sgs[num_out + num_in++] = &inhdr;
--- /dev/null
+From dd853fd216d1485ed3045ff772079cc8689a9a4a Mon Sep 17 00:00:00 2001
+From: Lukasz Odzioba <lukasz.odzioba@intel.com>
+Date: Wed, 28 Dec 2016 14:55:40 +0100
+Subject: x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option
+
+From: Lukasz Odzioba <lukasz.odzioba@intel.com>
+
+commit dd853fd216d1485ed3045ff772079cc8689a9a4a upstream.
+
+A negative number can be specified in the cmdline which will be used as
+setup_clear_cpu_cap() argument. With that we can clear/set some bit in
+memory predceeding boot_cpu_data/cpu_caps_cleared which may cause kernel
+to misbehave. This patch adds lower bound check to setup_disablecpuid().
+
+Boris Petkov reproduced a crash:
+
+ [ 1.234575] BUG: unable to handle kernel paging request at ffffffff858bd540
+ [ 1.236535] IP: memcpy_erms+0x6/0x10
+
+Signed-off-by: Lukasz Odzioba <lukasz.odzioba@intel.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: andi.kleen@intel.com
+Cc: bp@alien8.de
+Cc: dave.hansen@linux.intel.com
+Cc: luto@kernel.org
+Cc: slaoub@gmail.com
+Fixes: ac72e7888a61 ("x86: add generic clearcpuid=... option")
+Link: http://lkml.kernel.org/r/1482933340-11857-1-git-send-email-lukasz.odzioba@intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1275,7 +1275,7 @@ static __init int setup_disablecpuid(cha
+ {
+ int bit;
+
+- if (get_option(&arg, &bit) && bit < NCAPINTS*32)
++ if (get_option(&arg, &bit) && bit >= 0 && bit < NCAPINTS * 32)
+ setup_clear_cpu_cap(bit);
+ else
+ return 0;
projects / thirdparty / kernel / stable-queue.git / commitdiff
