--- /dev/null
+From f67b107d4ceddcf7aa65b706aaaf50d68edb52a6 Mon Sep 17 00:00:00 2001
+From: Marty Faltesek <mfaltesek@google.com>
+Date: Mon, 10 Oct 2016 19:00:04 +0300
+Subject: ath10k: cache calibration data when the core is stopped
+
+From: Marty Faltesek <mfaltesek@google.com>
+
+commit f67b107d4ceddcf7aa65b706aaaf50d68edb52a6 upstream.
+
+Commit 0b8e3c4ca29f ("ath10k: move cal data len to hw_params") broke retrieving
+the calibration data from cal_data debugfs file. The length of file was always
+zero. The reason is:
+
+ static ssize_t ath10k_debug_cal_data_read(struct file *file,
+ char __user *user_buf,
+ size_t count, loff_t *ppos)
+ {
+ struct ath10k *ar = file->private_data;
+ void *buf = file->private_data;
+
+This is obviously bogus, private_data cannot contain both struct ath10k and the
+buffer. Fix it by caching calibration data to ar->debug.cal_data. This also
+allows it to be accessed when the device is not active (interface is down).
+
+The cal_data buffer is fixed size because during the first firmware probe we
+don't yet know what will be the lenght of the calibration data. It was simplest
+just to use a fixed length. There's a WARN_ON() in
+ath10k_debug_cal_data_fetch() if the buffer is too small.
+
+Tested with qca988x and firmware 10.2.4.70.56.
+
+Reported-by: Nikolay Martynov <mar.kolya@gmail.com>
+Fixes: 0b8e3c4ca29f ("ath10k: move cal data len to hw_params")
+Signed-off-by: Marty Faltesek <mfaltesek@google.com>
+[kvalo@qca.qualcomm.com: improve commit log and minor other changes]
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath10k/core.h | 1
+ drivers/net/wireless/ath/ath10k/debug.c | 75 ++++++++++++++++----------------
+ 2 files changed, 40 insertions(+), 36 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.h
++++ b/drivers/net/wireless/ath/ath10k/core.h
+@@ -445,6 +445,7 @@ struct ath10k_debug {
+ u32 pktlog_filter;
+ u32 reg_addr;
+ u32 nf_cal_period;
++ void *cal_data;
+
+ struct ath10k_fw_crash_data *fw_crash_data;
+ };
+--- a/drivers/net/wireless/ath/ath10k/debug.c
++++ b/drivers/net/wireless/ath/ath10k/debug.c
+@@ -30,6 +30,8 @@
+ /* ms */
+ #define ATH10K_DEBUG_HTT_STATS_INTERVAL 1000
+
++#define ATH10K_DEBUG_CAL_DATA_LEN 12064
++
+ #define ATH10K_FW_CRASH_DUMP_VERSION 1
+
+ /**
+@@ -1450,56 +1452,51 @@ static const struct file_operations fops
+ .llseek = default_llseek,
+ };
+
+-static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file)
++static int ath10k_debug_cal_data_fetch(struct ath10k *ar)
+ {
+- struct ath10k *ar = inode->i_private;
+- void *buf;
+ u32 hi_addr;
+ __le32 addr;
+ int ret;
+
+- mutex_lock(&ar->conf_mutex);
+-
+- if (ar->state != ATH10K_STATE_ON &&
+- ar->state != ATH10K_STATE_UTF) {
+- ret = -ENETDOWN;
+- goto err;
+- }
++ lockdep_assert_held(&ar->conf_mutex);
+
+- buf = vmalloc(ar->hw_params.cal_data_len);
+- if (!buf) {
+- ret = -ENOMEM;
+- goto err;
+- }
++ if (WARN_ON(ar->hw_params.cal_data_len > ATH10K_DEBUG_CAL_DATA_LEN))
++ return -EINVAL;
+
+ hi_addr = host_interest_item_address(HI_ITEM(hi_board_data));
+
+ ret = ath10k_hif_diag_read(ar, hi_addr, &addr, sizeof(addr));
+ if (ret) {
+- ath10k_warn(ar, "failed to read hi_board_data address: %d\n", ret);
+- goto err_vfree;
++ ath10k_warn(ar, "failed to read hi_board_data address: %d\n",
++ ret);
++ return ret;
+ }
+
+- ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), buf,
++ ret = ath10k_hif_diag_read(ar, le32_to_cpu(addr), ar->debug.cal_data,
+ ar->hw_params.cal_data_len);
+ if (ret) {
+ ath10k_warn(ar, "failed to read calibration data: %d\n", ret);
+- goto err_vfree;
++ return ret;
+ }
+
+- file->private_data = buf;
++ return 0;
++}
+
+- mutex_unlock(&ar->conf_mutex);
++static int ath10k_debug_cal_data_open(struct inode *inode, struct file *file)
++{
++ struct ath10k *ar = inode->i_private;
+
+- return 0;
++ mutex_lock(&ar->conf_mutex);
+
+-err_vfree:
+- vfree(buf);
++ if (ar->state == ATH10K_STATE_ON ||
++ ar->state == ATH10K_STATE_UTF) {
++ ath10k_debug_cal_data_fetch(ar);
++ }
+
+-err:
++ file->private_data = ar;
+ mutex_unlock(&ar->conf_mutex);
+
+- return ret;
++ return 0;
+ }
+
+ static ssize_t ath10k_debug_cal_data_read(struct file *file,
+@@ -1507,18 +1504,16 @@ static ssize_t ath10k_debug_cal_data_rea
+ size_t count, loff_t *ppos)
+ {
+ struct ath10k *ar = file->private_data;
+- void *buf = file->private_data;
+
+- return simple_read_from_buffer(user_buf, count, ppos,
+- buf, ar->hw_params.cal_data_len);
+-}
++ mutex_lock(&ar->conf_mutex);
+
+-static int ath10k_debug_cal_data_release(struct inode *inode,
+- struct file *file)
+-{
+- vfree(file->private_data);
++ count = simple_read_from_buffer(user_buf, count, ppos,
++ ar->debug.cal_data,
++ ar->hw_params.cal_data_len);
+
+- return 0;
++ mutex_unlock(&ar->conf_mutex);
++
++ return count;
+ }
+
+ static ssize_t ath10k_write_ani_enable(struct file *file,
+@@ -1579,7 +1574,6 @@ static const struct file_operations fops
+ static const struct file_operations fops_cal_data = {
+ .open = ath10k_debug_cal_data_open,
+ .read = ath10k_debug_cal_data_read,
+- .release = ath10k_debug_cal_data_release,
+ .owner = THIS_MODULE,
+ .llseek = default_llseek,
+ };
+@@ -1931,6 +1925,8 @@ void ath10k_debug_stop(struct ath10k *ar
+ {
+ lockdep_assert_held(&ar->conf_mutex);
+
++ ath10k_debug_cal_data_fetch(ar);
++
+ /* Must not use _sync to avoid deadlock, we do that in
+ * ath10k_debug_destroy(). The check for htt_stats_mask is to avoid
+ * warning from del_timer(). */
+@@ -2343,6 +2339,10 @@ int ath10k_debug_create(struct ath10k *a
+ if (!ar->debug.fw_crash_data)
+ return -ENOMEM;
+
++ ar->debug.cal_data = vzalloc(ATH10K_DEBUG_CAL_DATA_LEN);
++ if (!ar->debug.cal_data)
++ return -ENOMEM;
++
+ INIT_LIST_HEAD(&ar->debug.fw_stats.pdevs);
+ INIT_LIST_HEAD(&ar->debug.fw_stats.vdevs);
+ INIT_LIST_HEAD(&ar->debug.fw_stats.peers);
+@@ -2356,6 +2356,9 @@ void ath10k_debug_destroy(struct ath10k
+ vfree(ar->debug.fw_crash_data);
+ ar->debug.fw_crash_data = NULL;
+
++ vfree(ar->debug.cal_data);
++ ar->debug.cal_data = NULL;
++
+ ath10k_debug_fw_stats_reset(ar);
+
+ kfree(ar->debug.tpc_stats);
--- /dev/null
+From 87d3b6588f9bf205902868d3e5baf68e37ad4ae1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 20 Oct 2016 17:05:30 +0200
+Subject: drm/fb-helper: Don't call dirty callback for untouched clips
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit 87d3b6588f9bf205902868d3e5baf68e37ad4ae1 upstream.
+
+Since 4.7 kernel, we've seen the error messages like
+
+ kernel: [TTM] Buffer eviction failed
+ kernel: qxl 0000:00:02.0: object_init failed for (4026540032, 0x00000001)
+ kernel: [drm:qxl_alloc_bo_reserved [qxl]] *ERROR* failed to allocate VRAM BO
+
+on QXL when switching and accessing on VT. The culprit was the
+generic deferred_io code (qxl driver switched to it since 4.7).
+There is a race between the dirty clip update and the call of
+callback.
+
+In drm_fb_helper_dirty(), the dirty clip is updated in the spinlock,
+while it kicks off the update worker outside the spinlock. Meanwhile
+the update worker clears the dirty clip in the spinlock, too. Thus,
+when drm_fb_helper_dirty() is called concurrently, schedule_work() is
+called after the clip is cleared in the first worker call.
+
+This patch addresses it by validating the clip before calling the
+dirty fb callback.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98322
+Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1003298
+Fixes: eaa434defaca ('drm/fb-helper: Add fb_deferred_io support')
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20161020150530.5787-1-tiwai@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -632,7 +632,9 @@ static void drm_fb_helper_dirty_work(str
+ clip->x2 = clip->y2 = 0;
+ spin_unlock_irqrestore(&helper->dirty_lock, flags);
+
+- helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1);
++ /* call dirty callback only when it has been really touched */
++ if (clip_copy.x1 < clip_copy.x2 && clip_copy.y1 < clip_copy.y2)
++ helper->fb->funcs->dirty(helper->fb, NULL, 0, 0, &clip_copy, 1);
+ }
+
+ /**
--- /dev/null
+From 7dfcb36a1f17e4c7c7c12b9d8a6902037c7d98dc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 26 Oct 2016 12:05:52 +0300
+Subject: drm/fb-helper: Fix connector ref leak on error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 7dfcb36a1f17e4c7c7c12b9d8a6902037c7d98dc upstream.
+
+We need to drop the connector references already taken when we
+abort in the middle of drm_fb_helper_single_add_all_connectors()
+
+Cc: Carlos Santa <carlos.santa@intel.com>
+Cc: Kirill A. Shutemov <kirill@shutemov.name>
+Tested-by: Carlos Santa <carlos.santa@intel.com>
+Tested-by: Kirill A. Shutemov <kirill@shutemov.name>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1477472755-15288-2-git-send-email-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -129,7 +129,12 @@ int drm_fb_helper_single_add_all_connect
+ return 0;
+ fail:
+ for (i = 0; i < fb_helper->connector_count; i++) {
+- kfree(fb_helper->connector_info[i]);
++ struct drm_fb_helper_connector *fb_helper_connector =
++ fb_helper->connector_info[i];
++
++ drm_connector_unreference(fb_helper_connector->connector);
++
++ kfree(fb_helper_connector);
+ fb_helper->connector_info[i] = NULL;
+ }
+ fb_helper->connector_count = 0;
--- /dev/null
+From a2889606636d135148de101fe3311dfea67baf1c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 26 Oct 2016 17:41:18 +0300
+Subject: drm/fb-helper: Keep references for the current set of used connectors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit a2889606636d135148de101fe3311dfea67baf1c upstream.
+
+The fbdev helper code keeps around two lists of connectors. One is the
+list of all connectors it could use, and that list already holds
+references for all the connectors. However the other list, or rather
+lists, is the one actively being used. That list is tracked per-crtc
+and currently doesn't hold any extra references. Let's grab those
+extra references to avoid oopsing when the connector vanishes. The
+list of all possible connectors should get updated when the hpd happens,
+but the list of actively used connectors would not get updated until
+the next time the fb-helper picks through the set of possible connectors.
+And so we need to hang on to the connectors until that time.
+
+Since we need to clean up in drm_fb_helper_crtc_free() as well,
+let's pull the code to a common place. And while at it let's
+pull in up the modeset->mode cleanup in there as well. The case
+of modeset->fb is a bit less clear. I'm thinking we should probably
+hold a reference to it, but for now I just slapped on a FIXME.
+
+v2: Cleanup things drm_fb_helper_crtc_free() too (Chris)
+v3: Don't leak modeset->connectors (Chris)
+
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Carlos Santa <carlos.santa@intel.com>
+Cc: Kirill A. Shutemov <kirill@shutemov.name>
+Tested-by: Carlos Santa <carlos.santa@intel.com> (v1)
+Tested-by: Kirill A. Shutemov <kirill@shutemov.name> (v1)
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97666
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/1477492878-4990-1-git-send-email-ville.syrjala@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 57 +++++++++++++++++++++++-----------------
+ 1 file changed, 33 insertions(+), 24 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -606,6 +606,24 @@ int drm_fb_helper_blank(int blank, struc
+ }
+ EXPORT_SYMBOL(drm_fb_helper_blank);
+
++static void drm_fb_helper_modeset_release(struct drm_fb_helper *helper,
++ struct drm_mode_set *modeset)
++{
++ int i;
++
++ for (i = 0; i < modeset->num_connectors; i++) {
++ drm_connector_unreference(modeset->connectors[i]);
++ modeset->connectors[i] = NULL;
++ }
++ modeset->num_connectors = 0;
++
++ drm_mode_destroy(helper->dev, modeset->mode);
++ modeset->mode = NULL;
++
++ /* FIXME should hold a ref? */
++ modeset->fb = NULL;
++}
++
+ static void drm_fb_helper_crtc_free(struct drm_fb_helper *helper)
+ {
+ int i;
+@@ -615,10 +633,12 @@ static void drm_fb_helper_crtc_free(stru
+ kfree(helper->connector_info[i]);
+ }
+ kfree(helper->connector_info);
++
+ for (i = 0; i < helper->crtc_count; i++) {
+- kfree(helper->crtc_info[i].mode_set.connectors);
+- if (helper->crtc_info[i].mode_set.mode)
+- drm_mode_destroy(helper->dev, helper->crtc_info[i].mode_set.mode);
++ struct drm_mode_set *modeset = &helper->crtc_info[i].mode_set;
++
++ drm_fb_helper_modeset_release(helper, modeset);
++ kfree(modeset->connectors);
+ }
+ kfree(helper->crtc_info);
+ }
+@@ -2034,7 +2054,6 @@ static void drm_setup_crtcs(struct drm_f
+ struct drm_fb_helper_crtc **crtcs;
+ struct drm_display_mode **modes;
+ struct drm_fb_offset *offsets;
+- struct drm_mode_set *modeset;
+ bool *enabled;
+ int width, height;
+ int i;
+@@ -2082,45 +2101,35 @@ static void drm_setup_crtcs(struct drm_f
+
+ /* need to set the modesets up here for use later */
+ /* fill out the connector<->crtc mappings into the modesets */
+- for (i = 0; i < fb_helper->crtc_count; i++) {
+- modeset = &fb_helper->crtc_info[i].mode_set;
+- modeset->num_connectors = 0;
+- modeset->fb = NULL;
+- }
++ for (i = 0; i < fb_helper->crtc_count; i++)
++ drm_fb_helper_modeset_release(fb_helper,
++ &fb_helper->crtc_info[i].mode_set);
+
+ for (i = 0; i < fb_helper->connector_count; i++) {
+ struct drm_display_mode *mode = modes[i];
+ struct drm_fb_helper_crtc *fb_crtc = crtcs[i];
+ struct drm_fb_offset *offset = &offsets[i];
+- modeset = &fb_crtc->mode_set;
++ struct drm_mode_set *modeset = &fb_crtc->mode_set;
+
+ if (mode && fb_crtc) {
++ struct drm_connector *connector =
++ fb_helper->connector_info[i]->connector;
++
+ DRM_DEBUG_KMS("desired mode %s set on crtc %d (%d,%d)\n",
+ mode->name, fb_crtc->mode_set.crtc->base.id, offset->x, offset->y);
++
+ fb_crtc->desired_mode = mode;
+ fb_crtc->x = offset->x;
+ fb_crtc->y = offset->y;
+- if (modeset->mode)
+- drm_mode_destroy(dev, modeset->mode);
+ modeset->mode = drm_mode_duplicate(dev,
+ fb_crtc->desired_mode);
+- modeset->connectors[modeset->num_connectors++] = fb_helper->connector_info[i]->connector;
++ drm_connector_reference(connector);
++ modeset->connectors[modeset->num_connectors++] = connector;
+ modeset->fb = fb_helper->fb;
+ modeset->x = offset->x;
+ modeset->y = offset->y;
+ }
+ }
+-
+- /* Clear out any old modes if there are no more connected outputs. */
+- for (i = 0; i < fb_helper->crtc_count; i++) {
+- modeset = &fb_helper->crtc_info[i].mode_set;
+- if (modeset->num_connectors == 0) {
+- BUG_ON(modeset->fb);
+- if (modeset->mode)
+- drm_mode_destroy(dev, modeset->mode);
+- modeset->mode = NULL;
+- }
+- }
+ out:
+ kfree(crtcs);
+ kfree(modes);
--- /dev/null
+From e73aca5184ad9fc948ba22b4d35dce11db35bb25 Mon Sep 17 00:00:00 2001
+From: Liu Ying <gnuiyl@gmail.com>
+Date: Tue, 18 Oct 2016 16:44:03 +0800
+Subject: drm/imx: ipuv3-plane: Access old u/vbo properly in ->atomic_check for YU12/YV12
+
+From: Liu Ying <gnuiyl@gmail.com>
+
+commit e73aca5184ad9fc948ba22b4d35dce11db35bb25 upstream.
+
+Before accessing the u/v offset(aka, u/vbo for IPUv3) of the old plane state's
+relevant fb, we should make sure the fb is in YU12 or YV12 pixel format(which
+are the two YUV pixel formats we support only), otherwise, we are likely to
+trigger BUG_ON() in drm_plane_state_to_u/vbo() since the fb's pixel format is
+probably not YU12 or YV12.
+
+Link: https://bugs.freedesktop.org/show_bug.cgi?id=98150
+Fixes: c6c1f9bc798b ("drm/imx: Add active plane reconfiguration support")
+Signed-off-by: Liu Ying <gnuiyl@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/imx/ipuv3-plane.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/imx/ipuv3-plane.c
++++ b/drivers/gpu/drm/imx/ipuv3-plane.c
+@@ -360,7 +360,9 @@ static int ipu_plane_atomic_check(struct
+ if ((ubo > 0xfffff8) || (vbo > 0xfffff8))
+ return -EINVAL;
+
+- if (old_fb) {
++ if (old_fb &&
++ (old_fb->pixel_format == DRM_FORMAT_YUV420 ||
++ old_fb->pixel_format == DRM_FORMAT_YVU420)) {
+ old_ubo = drm_plane_state_to_ubo(old_state);
+ old_vbo = drm_plane_state_to_vbo(old_state);
+ if (ubo != old_ubo || vbo != old_vbo)
--- /dev/null
+From 43daa01323da37a3692cabe1579ef5c2c4372e06 Mon Sep 17 00:00:00 2001
+From: Liu Ying <gnuiyl@gmail.com>
+Date: Mon, 10 Oct 2016 14:50:06 +0800
+Subject: drm/imx: ipuv3-plane: Switch EBA buffer only when we don't need modeset
+
+From: Liu Ying <gnuiyl@gmail.com>
+
+commit 43daa01323da37a3692cabe1579ef5c2c4372e06 upstream.
+
+We added active plane reconfiguration support by forcing a full modeset
+operation. So, looking at old_plane_state->fb to determine whether we need to
+switch EBA buffer(for hardware double buffering) in ipu_plane_atomic_set_base()
+or not is no more correct. Instead, we should do that only when we don't need
+modeset, otherwise, we initialize the two EBA buffers with the buffer address.
+
+Fixes: c6c1f9bc798b ("drm/imx: Add active plane reconfiguration support")
+Signed-off-by: Liu Ying <gnuiyl@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/imx/ipuv3-plane.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/imx/ipuv3-plane.c
++++ b/drivers/gpu/drm/imx/ipuv3-plane.c
+@@ -108,6 +108,7 @@ static void ipu_plane_atomic_set_base(st
+ {
+ struct drm_plane *plane = &ipu_plane->base;
+ struct drm_plane_state *state = plane->state;
++ struct drm_crtc_state *crtc_state = state->crtc->state;
+ struct drm_framebuffer *fb = state->fb;
+ unsigned long eba, ubo, vbo;
+ int active;
+@@ -149,7 +150,7 @@ static void ipu_plane_atomic_set_base(st
+ break;
+ }
+
+- if (old_state->fb) {
++ if (!drm_atomic_crtc_needs_modeset(crtc_state)) {
+ active = ipu_idmac_get_current_buffer(ipu_plane->ipu_ch);
+ ipu_cpmem_set_buffer(ipu_plane->ipu_ch, !active, eba);
+ ipu_idmac_select_buffer(ipu_plane->ipu_ch, !active);
--- /dev/null
+From b0a6af8b34c9ad20894aa46f85f4bf59d444f286 Mon Sep 17 00:00:00 2001
+From: Peter Wu <peter@lekensteyn.nl>
+Date: Mon, 31 Oct 2016 23:48:22 +0100
+Subject: drm/nouveau/acpi: fix check for power resources support
+
+From: Peter Wu <peter@lekensteyn.nl>
+
+commit b0a6af8b34c9ad20894aa46f85f4bf59d444f286 upstream.
+
+Check whether the kernel really supports power resources for a device,
+otherwise the power might not be removed when the device is runtime
+suspended (DSM should still work in these cases where PR does not).
+
+This is a workaround for a problem where ACPICA and Windows 10 differ in
+behavior. ACPICA does not correctly enumerate power resources within a
+conditional block (due to delayed execution of such blocks) and as a
+result power_resources is set to false even if _PR3 exists.
+
+Fixes: 692a17dcc292 ("drm/nouveau/acpi: fix lockup with PCIe runtime PM")
+Link: https://bugs.freedesktop.org/show_bug.cgi?id=98398
+Reported-and-tested-by: Rick Kerkhof <rick.2889@gmail.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Peter Wu <peter@lekensteyn.nl>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_acpi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
++++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
+@@ -240,7 +240,8 @@ static bool nouveau_pr3_present(struct p
+ if (!parent_adev)
+ return false;
+
+- return acpi_has_method(parent_adev->handle, "_PR3");
++ return parent_adev->power.flags.power_resources &&
++ acpi_has_method(parent_adev->handle, "_PR3");
+ }
+
+ static void nouveau_dsm_pci_probe(struct pci_dev *pdev, acpi_handle *dhandle_out,
--- /dev/null
+From 537b4b462caa8bfb9726d9695b8e56e2d5e6b41e Mon Sep 17 00:00:00 2001
+From: Lucas Stach <dev@lynxeye.de>
+Date: Mon, 24 Oct 2016 23:32:04 +0200
+Subject: drm/radeon: drop register readback in cayman_cp_int_cntl_setup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lucas Stach <dev@lynxeye.de>
+
+commit 537b4b462caa8bfb9726d9695b8e56e2d5e6b41e upstream.
+
+The read is taking a considerable amount of time (about 50us on this
+machine). The register does not ever hold anything other than the ring
+ID that is updated in this exact function, so there is no need for
+the read modify write cycle.
+
+This chops off a big chunk of the time spent in hardirq disabled
+context, as this function is called multiple times in the interrupt
+handler. With this change applied radeon won't show up in the list
+of the worst IRQ latency offenders anymore, where it was a regular
+before.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Lucas Stach <dev@lynxeye.de>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/ni.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1396,9 +1396,7 @@ static void cayman_pcie_gart_fini(struct
+ void cayman_cp_int_cntl_setup(struct radeon_device *rdev,
+ int ring, u32 cp_int_cntl)
+ {
+- u32 srbm_gfx_cntl = RREG32(SRBM_GFX_CNTL) & ~3;
+-
+- WREG32(SRBM_GFX_CNTL, srbm_gfx_cntl | (ring & 3));
++ WREG32(SRBM_GFX_CNTL, RINGID(ring));
+ WREG32(CP_INT_CNTL, cp_int_cntl);
+ }
+
--- /dev/null
+From fb9a5b0c1c9893db2e0d18544fd49e19d784a87d Mon Sep 17 00:00:00 2001
+From: Tom St Denis <tom.stdenis@amd.com>
+Date: Thu, 13 Oct 2016 12:38:07 -0400
+Subject: drm/radeon/si_dpm: Limit clocks on HD86xx part
+
+From: Tom St Denis <tom.stdenis@amd.com>
+
+commit fb9a5b0c1c9893db2e0d18544fd49e19d784a87d upstream.
+
+Limit clocks on a specific HD86xx part to avoid
+crashes (while awaiting an appropriate PP fix).
+
+Signed-off-by: Tom St Denis <tom.stdenis@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -3021,6 +3021,12 @@ static void si_apply_state_adjust_rules(
+ max_sclk = 75000;
+ max_mclk = 80000;
+ }
++ /* limit clocks on HD8600 series */
++ if (rdev->pdev->device == 0x6660 &&
++ rdev->pdev->revision == 0x83) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
+
+ if (rps->vce_active) {
+ rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
--- /dev/null
+From 7dc86ef5ac91642dfc3eb93ee0f0458e702a343e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 14 Oct 2016 16:38:02 -0400
+Subject: drm/radeon/si_dpm: workaround for SI kickers
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 7dc86ef5ac91642dfc3eb93ee0f0458e702a343e upstream.
+
+Consolidate existing quirks. Fixes stability issues
+on some kickers.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/si_dpm.c | 59 +++++++++++++++++++++++++++++-----------
+ 1 file changed, 43 insertions(+), 16 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2999,6 +2999,49 @@ static void si_apply_state_adjust_rules(
+ int i;
+ struct si_dpm_quirk *p = si_dpm_quirk_list;
+
++ /* limit all SI kickers */
++ if (rdev->family == CHIP_PITCAIRN) {
++ if ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->device == 0x6810) ||
++ (rdev->pdev->device == 0x6811) ||
++ (rdev->pdev->device == 0x6816) ||
++ (rdev->pdev->device == 0x6817) ||
++ (rdev->pdev->device == 0x6806))
++ max_mclk = 120000;
++ } else if (rdev->family == CHIP_VERDE) {
++ if ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->revision == 0x87) ||
++ (rdev->pdev->device == 0x6820) ||
++ (rdev->pdev->device == 0x6821) ||
++ (rdev->pdev->device == 0x6822) ||
++ (rdev->pdev->device == 0x6823) ||
++ (rdev->pdev->device == 0x682A) ||
++ (rdev->pdev->device == 0x682B)) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
++ } else if (rdev->family == CHIP_OLAND) {
++ if ((rdev->pdev->revision == 0xC7) ||
++ (rdev->pdev->revision == 0x80) ||
++ (rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->device == 0x6604) ||
++ (rdev->pdev->device == 0x6605)) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
++ } else if (rdev->family == CHIP_HAINAN) {
++ if ((rdev->pdev->revision == 0x81) ||
++ (rdev->pdev->revision == 0x83) ||
++ (rdev->pdev->revision == 0xC3) ||
++ (rdev->pdev->device == 0x6664) ||
++ (rdev->pdev->device == 0x6665) ||
++ (rdev->pdev->device == 0x6667)) {
++ max_sclk = 75000;
++ max_mclk = 80000;
++ }
++ }
+ /* Apply dpm quirks */
+ while (p && p->chip_device != 0) {
+ if (rdev->pdev->vendor == p->chip_vendor &&
+@@ -3011,22 +3054,6 @@ static void si_apply_state_adjust_rules(
+ }
+ ++p;
+ }
+- /* limit mclk on all R7 370 parts for stability */
+- if (rdev->pdev->device == 0x6811 &&
+- rdev->pdev->revision == 0x81)
+- max_mclk = 120000;
+- /* limit sclk/mclk on Jet parts for stability */
+- if (rdev->pdev->device == 0x6665 &&
+- rdev->pdev->revision == 0xc3) {
+- max_sclk = 75000;
+- max_mclk = 80000;
+- }
+- /* limit clocks on HD8600 series */
+- if (rdev->pdev->device == 0x6660 &&
+- rdev->pdev->revision == 0x83) {
+- max_sclk = 75000;
+- max_mclk = 80000;
+- }
+
+ if (rps->vce_active) {
+ rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
--- /dev/null
+From ea720935cf6686f72def9d322298bf7e9bd53377 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 5 Oct 2016 10:14:42 +0200
+Subject: mac80211: discard multicast and 4-addr A-MSDUs
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit ea720935cf6686f72def9d322298bf7e9bd53377 upstream.
+
+In mac80211, multicast A-MSDUs are accepted in many cases that
+they shouldn't be accepted in:
+ * drop A-MSDUs with a multicast A1 (RA), as required by the
+ spec in 9.11 (802.11-2012 version)
+ * drop A-MSDUs with a 4-addr header, since the fourth address
+ can't actually be useful for them; unless 4-address frame
+ format is actually requested, even though the fourth address
+ is still not useful in this case, but ignored
+
+Accepting the first case, in particular, is very problematic
+since it allows anyone else with possession of a GTK to send
+unicast frames encapsulated in a multicast A-MSDU, even when
+the AP has client isolation enabled.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/mac80211/rx.c | 24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2253,16 +2253,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ if (!(status->rx_flags & IEEE80211_RX_AMSDU))
+ return RX_CONTINUE;
+
+- if (ieee80211_has_a4(hdr->frame_control) &&
+- rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+- !rx->sdata->u.vlan.sta)
+- return RX_DROP_UNUSABLE;
++ if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
++ switch (rx->sdata->vif.type) {
++ case NL80211_IFTYPE_AP_VLAN:
++ if (!rx->sdata->u.vlan.sta)
++ return RX_DROP_UNUSABLE;
++ break;
++ case NL80211_IFTYPE_STATION:
++ if (!rx->sdata->u.mgd.use_4addr)
++ return RX_DROP_UNUSABLE;
++ break;
++ default:
++ return RX_DROP_UNUSABLE;
++ }
++ }
+
+- if (is_multicast_ether_addr(hdr->addr1) &&
+- ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+- rx->sdata->u.vlan.sta) ||
+- (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
+- rx->sdata->u.mgd.use_4addr)))
++ if (is_multicast_ether_addr(hdr->addr1))
+ return RX_DROP_UNUSABLE;
+
+ skb->dev = dev;
--- /dev/null
+From 1217e1d1999ed6c9c1e1b1acae0a74ab70464ae2 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 28 Oct 2016 15:59:41 +1100
+Subject: md: be careful not lot leak internal curr_resync value into metadata. -- (all)
+
+From: NeilBrown <neilb@suse.com>
+
+commit 1217e1d1999ed6c9c1e1b1acae0a74ab70464ae2 upstream.
+
+mddev->curr_resync usually records where the current resync is up to,
+but during the starting phase it has some "magic" values.
+
+ 1 - means that the array is trying to start a resync, but has yielded
+ to another array which shares physical devices, and also needs to
+ start a resync
+ 2 - means the array is trying to start resync, but has found another
+ array which shares physical devices and has already started resync.
+
+ 3 - means that resync has commensed, but it is possible that nothing
+ has actually been resynced yet.
+
+It is important that this value not be visible to user-space and
+particularly that it doesn't get written to the metadata, as the
+resync or recovery checkpoint. In part, this is because it may be
+slightly higher than the correct value, though this is very rare.
+In part, because it is not a multiple of 4K, and some devices only
+support 4K aligned accesses.
+
+There are two places where this value is propagates into either
+->curr_resync_completed or ->recovery_cp or ->recovery_offset.
+These currently avoid the propagation of values 1 and 3, but will
+allow 3 to leak through.
+
+Change them to only propagate the value if it is > 3.
+
+As this can cause an array to fail, the patch is suitable for -stable.
+
+Reported-by: Viswesh <viswesh.vichu@gmail.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -8120,14 +8120,14 @@ void md_do_sync(struct md_thread *thread
+
+ if (!test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
+ !test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
+- mddev->curr_resync > 2) {
++ mddev->curr_resync > 3) {
+ mddev->curr_resync_completed = mddev->curr_resync;
+ sysfs_notify(&mddev->kobj, NULL, "sync_completed");
+ }
+ mddev->pers->sync_request(mddev, max_sectors, &skipped);
+
+ if (!test_bit(MD_RECOVERY_CHECK, &mddev->recovery) &&
+- mddev->curr_resync > 2) {
++ mddev->curr_resync > 3) {
+ if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery)) {
+ if (test_bit(MD_RECOVERY_INTR, &mddev->recovery)) {
+ if (mddev->curr_resync >= mddev->recovery_cp) {
--- /dev/null
+From 45c7a4908a307a023e237a64a3eadcafc4836493 Mon Sep 17 00:00:00 2001
+From: Jaehoon Chung <jh80.chung@samsung.com>
+Date: Fri, 21 Oct 2016 19:57:57 +0900
+Subject: mmc: dw_mmc-pltfm: fix the potential NULL pointer dereference
+
+From: Jaehoon Chung <jh80.chung@samsung.com>
+
+commit 45c7a4908a307a023e237a64a3eadcafc4836493 upstream.
+
+platform_get_resource can be returned the NULL pointer.
+Then regs->start should be referred to NULL Pointer.
+devm_ioremap_resource() checks whether res is NULL or not.
+
+Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
+Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/dw_mmc-pltfm.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/dw_mmc-pltfm.c
++++ b/drivers/mmc/host/dw_mmc-pltfm.c
+@@ -46,12 +46,13 @@ int dw_mci_pltfm_register(struct platfor
+ host->pdata = pdev->dev.platform_data;
+
+ regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- /* Get registers' physical base address */
+- host->phy_regs = regs->start;
+ host->regs = devm_ioremap_resource(&pdev->dev, regs);
+ if (IS_ERR(host->regs))
+ return PTR_ERR(host->regs);
+
++ /* Get registers' physical base address */
++ host->phy_regs = regs->start;
++
+ platform_set_drvdata(pdev, host);
+ return dw_mci_probe(host);
+ }
--- /dev/null
+From e3f948cd3283e4fbe5907f1f3967c839912f480e Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@fb.com>
+Date: Thu, 6 Oct 2016 14:09:16 -0700
+Subject: RAID1: ignore discard error
+
+From: Shaohua Li <shli@fb.com>
+
+commit e3f948cd3283e4fbe5907f1f3967c839912f480e upstream.
+
+If a write error occurs, raid1 will try to rewrite the bio in small
+chunk size. If the rewrite fails, raid1 will record the error in bad
+block. narrow_write_error will always use WRITE for the bio, but
+actually it could be a discard. Since discard bio hasn't payload, write
+the bio will cause different issues. But discard error isn't fatal, we
+can safely ignore it. This is what this patch does.
+
+This issue should exist since discard is added, but only exposed with
+recent arbitrary bio size feature.
+
+Reported-and-tested-by: Sitsofe Wheeler <sitsofe@gmail.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid1.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -407,11 +407,14 @@ static void raid1_end_write_request(stru
+ struct bio *to_put = NULL;
+ int mirror = find_bio_disk(r1_bio, bio);
+ struct md_rdev *rdev = conf->mirrors[mirror].rdev;
++ bool discard_error;
++
++ discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD;
+
+ /*
+ * 'one mirror IO has finished' event handler:
+ */
+- if (bio->bi_error) {
++ if (bio->bi_error && !discard_error) {
+ set_bit(WriteErrorSeen, &rdev->flags);
+ if (!test_and_set_bit(WantReplacement, &rdev->flags))
+ set_bit(MD_RECOVERY_NEEDED, &
+@@ -448,7 +451,7 @@ static void raid1_end_write_request(stru
+
+ /* Maybe we can clear some bad blocks. */
+ if (is_badblock(rdev, r1_bio->sector, r1_bio->sectors,
+- &first_bad, &bad_sectors)) {
++ &first_bad, &bad_sectors) && !discard_error) {
+ r1_bio->bios[mirror] = IO_MADE_GOOD;
+ set_bit(R1BIO_MadeGood, &r1_bio->state);
+ }
--- /dev/null
+From 579ed34f7b751b8add233cba4cf755258dbdd60a Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@fb.com>
+Date: Thu, 6 Oct 2016 14:13:52 -0700
+Subject: RAID10: ignore discard error
+
+From: Shaohua Li <shli@fb.com>
+
+commit 579ed34f7b751b8add233cba4cf755258dbdd60a upstream.
+
+This is the counterpart of raid10 fix. If a write error occurs, raid10
+will try to rewrite the bio in small chunk size. If the rewrite fails,
+raid10 will record the error in bad block. narrow_write_error will
+always use WRITE for the bio, but actually it could be a discard. Since
+discard bio hasn't payload, write the bio will cause different issues.
+But discard error isn't fatal, we can safely ignore it. This is what
+this patch does.
+
+This issue should exist since discard is added, but only exposed with
+recent arbitrary bio size feature.
+
+Cc: Sitsofe Wheeler <sitsofe@gmail.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/raid10.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -447,6 +447,9 @@ static void raid10_end_write_request(str
+ struct r10conf *conf = r10_bio->mddev->private;
+ int slot, repl;
+ struct md_rdev *rdev = NULL;
++ bool discard_error;
++
++ discard_error = bio->bi_error && bio_op(bio) == REQ_OP_DISCARD;
+
+ dev = find_bio_disk(conf, r10_bio, bio, &slot, &repl);
+
+@@ -460,7 +463,7 @@ static void raid10_end_write_request(str
+ /*
+ * this branch is our 'one mirror IO has finished' event handler:
+ */
+- if (bio->bi_error) {
++ if (bio->bi_error && !discard_error) {
+ if (repl)
+ /* Never record new bad blocks to replacement,
+ * just fail it.
+@@ -503,7 +506,7 @@ static void raid10_end_write_request(str
+ if (is_badblock(rdev,
+ r10_bio->devs[slot].addr,
+ r10_bio->sectors,
+- &first_bad, &bad_sectors)) {
++ &first_bad, &bad_sectors) && !discard_error) {
+ bio_put(bio);
+ if (repl)
+ r10_bio->devs[slot].repl_bio = IO_MADE_GOOD;
--- /dev/null
+From 304e5ac118cc351eb047b6c433a89e13ea7259cf Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 11 Oct 2016 19:46:49 +0200
+Subject: Revert "ath9k_hw: implement temperature compensation support for AR9003+"
+
+From: Felix Fietkau <nbd@nbd.name>
+
+commit 304e5ac118cc351eb047b6c433a89e13ea7259cf upstream.
+
+This reverts commit 171f6402e4aa ("ath9k_hw: implement temperature compensation
+support for AR9003+"). Some users report that this commit causes a regression
+in performance under some conditions.
+
+Fixes: 171f6402e4aa ("ath9k_hw: implement temperature compensation support for AR9003+")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+[kvalo@qca.qualcomm.com: improve commit log]
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/ar9003_calib.c | 25 +++----------------------
+ drivers/net/wireless/ath/ath9k/hw.h | 1 -
+ 2 files changed, 3 insertions(+), 23 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+@@ -33,7 +33,6 @@ struct coeff {
+
+ enum ar9003_cal_types {
+ IQ_MISMATCH_CAL = BIT(0),
+- TEMP_COMP_CAL = BIT(1),
+ };
+
+ static void ar9003_hw_setup_calibration(struct ath_hw *ah,
+@@ -59,12 +58,6 @@ static void ar9003_hw_setup_calibration(
+ /* Kick-off cal */
+ REG_SET_BIT(ah, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
+ break;
+- case TEMP_COMP_CAL:
+- ath_dbg(common, CALIBRATE,
+- "starting Temperature Compensation Calibration\n");
+- REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_LOCAL);
+- REG_SET_BIT(ah, AR_CH0_THERM, AR_CH0_THERM_START);
+- break;
+ default:
+ ath_err(common, "Invalid calibration type\n");
+ break;
+@@ -93,8 +86,7 @@ static bool ar9003_hw_per_calibration(st
+ /*
+ * Accumulate cal measures for active chains
+ */
+- if (cur_caldata->calCollect)
+- cur_caldata->calCollect(ah);
++ cur_caldata->calCollect(ah);
+ ah->cal_samples++;
+
+ if (ah->cal_samples >= cur_caldata->calNumSamples) {
+@@ -107,8 +99,7 @@ static bool ar9003_hw_per_calibration(st
+ /*
+ * Process accumulated data
+ */
+- if (cur_caldata->calPostProc)
+- cur_caldata->calPostProc(ah, numChains);
++ cur_caldata->calPostProc(ah, numChains);
+
+ /* Calibration has finished. */
+ caldata->CalValid |= cur_caldata->calType;
+@@ -323,16 +314,9 @@ static const struct ath9k_percal_data iq
+ ar9003_hw_iqcalibrate
+ };
+
+-static const struct ath9k_percal_data temp_cal_single_sample = {
+- TEMP_COMP_CAL,
+- MIN_CAL_SAMPLES,
+- PER_MAX_LOG_COUNT,
+-};
+-
+ static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
+ {
+ ah->iq_caldata.calData = &iq_cal_single_sample;
+- ah->temp_caldata.calData = &temp_cal_single_sample;
+
+ if (AR_SREV_9300_20_OR_LATER(ah)) {
+ ah->enabled_cals |= TX_IQ_CAL;
+@@ -340,7 +324,7 @@ static void ar9003_hw_init_cal_settings(
+ ah->enabled_cals |= TX_IQ_ON_AGC_CAL;
+ }
+
+- ah->supp_cals = IQ_MISMATCH_CAL | TEMP_COMP_CAL;
++ ah->supp_cals = IQ_MISMATCH_CAL;
+ }
+
+ #define OFF_UPPER_LT 24
+@@ -1399,9 +1383,6 @@ static void ar9003_hw_init_cal_common(st
+ INIT_CAL(&ah->iq_caldata);
+ INSERT_CAL(ah, &ah->iq_caldata);
+
+- INIT_CAL(&ah->temp_caldata);
+- INSERT_CAL(ah, &ah->temp_caldata);
+-
+ /* Initialize current pointer to first element in list */
+ ah->cal_list_curr = ah->cal_list;
+
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -830,7 +830,6 @@ struct ath_hw {
+ /* Calibration */
+ u32 supp_cals;
+ struct ath9k_cal_list iq_caldata;
+- struct ath9k_cal_list temp_caldata;
+ struct ath9k_cal_list adcgain_caldata;
+ struct ath9k_cal_list adcdc_caldata;
+ struct ath9k_cal_list *cal_list;
--- /dev/null
+From 9dc79965b21967caebde575f5f5d8bf1aa2c23ab Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <michel.daenzer@amd.com>
+Date: Mon, 24 Oct 2016 16:52:20 +0900
+Subject: Revert "drm/radeon: fix DP link training issue with second 4K monitor"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <michel.daenzer@amd.com>
+
+commit 9dc79965b21967caebde575f5f5d8bf1aa2c23ab upstream.
+
+This reverts commit 1a738347df2ee4977459a8776fe2c62196bdcb1b.
+
+It caused at least some Kaveri laptops to incorrectly report DisplayPort
+connectors as connected.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97857
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_dp_auxch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c
++++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
+@@ -105,7 +105,7 @@ radeon_dp_aux_transfer_native(struct drm
+
+ tmp &= AUX_HPD_SEL(0x7);
+ tmp |= AUX_HPD_SEL(chan->rec.hpd);
+- tmp |= AUX_EN | AUX_LS_READ_EN | AUX_HPD_DISCON(0x1);
++ tmp |= AUX_EN | AUX_LS_READ_EN;
+
+ WREG32(AUX_CONTROL + aux_offset[instance], tmp);
+
--- /dev/null
+From 2bf7dc8443e113844d078fd6541b7f4aa544f92f Mon Sep 17 00:00:00 2001
+From: Ching Huang <ching2048@areca.com.tw>
+Date: Wed, 19 Oct 2016 17:50:26 +0800
+Subject: scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware
+
+From: Ching Huang <ching2048@areca.com.tw>
+
+commit 2bf7dc8443e113844d078fd6541b7f4aa544f92f upstream.
+
+The arcmsr driver failed to pass SYNCHRONIZE CACHE to controller
+firmware. Depending on how drive caches are handled internally by
+controller firmware this could potentially lead to data integrity
+problems.
+
+Ensure that cache flushes are passed to the controller.
+
+[mkp: applied by hand and removed unused vars]
+
+Signed-off-by: Ching Huang <ching2048@areca.com.tw>
+Reported-by: Tomas Henzl <thenzl@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/arcmsr/arcmsr_hba.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/scsi/arcmsr/arcmsr_hba.c
++++ b/drivers/scsi/arcmsr/arcmsr_hba.c
+@@ -2636,18 +2636,9 @@ static int arcmsr_queue_command_lck(stru
+ struct AdapterControlBlock *acb = (struct AdapterControlBlock *) host->hostdata;
+ struct CommandControlBlock *ccb;
+ int target = cmd->device->id;
+- int lun = cmd->device->lun;
+- uint8_t scsicmd = cmd->cmnd[0];
+ cmd->scsi_done = done;
+ cmd->host_scribble = NULL;
+ cmd->result = 0;
+- if ((scsicmd == SYNCHRONIZE_CACHE) ||(scsicmd == SEND_DIAGNOSTIC)){
+- if(acb->devstate[target][lun] == ARECA_RAID_GONE) {
+- cmd->result = (DID_NO_CONNECT << 16);
+- }
+- cmd->scsi_done(cmd);
+- return 0;
+- }
+ if (target == 16) {
+ /* virtual device for iop message transfer */
+ arcmsr_handle_virtual_command(acb, cmd);
--- /dev/null
+From 1e793f6fc0db920400574211c48f9157a37e3945 Mon Sep 17 00:00:00 2001
+From: Kashyap Desai <kashyap.desai@broadcom.com>
+Date: Fri, 21 Oct 2016 06:33:32 -0700
+Subject: scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices
+
+From: Kashyap Desai <kashyap.desai@broadcom.com>
+
+commit 1e793f6fc0db920400574211c48f9157a37e3945 upstream.
+
+Commit 02b01e010afe ("megaraid_sas: return sync cache call with
+success") modified the driver to successfully complete SYNCHRONIZE_CACHE
+commands without passing them to the controller. Disk drive caches are
+only explicitly managed by controller firmware when operating in RAID
+mode. So this commit effectively disabled writeback cache flushing for
+any drives used in JBOD mode, leading to data integrity failures.
+
+[mkp: clarified patch description]
+
+Fixes: 02b01e010afeeb49328d35650d70721d2ca3fd59
+Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
+Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Reviewed-by: Tomas Henzl <thenzl@redhat.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -1713,16 +1713,13 @@ megasas_queue_command(struct Scsi_Host *
+ goto out_done;
+ }
+
+- switch (scmd->cmnd[0]) {
+- case SYNCHRONIZE_CACHE:
+- /*
+- * FW takes care of flush cache on its own
+- * No need to send it down
+- */
++ /*
++ * FW takes care of flush cache on its own for Virtual Disk.
++ * No need to send it down for VD. For JBOD send SYNCHRONIZE_CACHE to FW.
++ */
++ if ((scmd->cmnd[0] == SYNCHRONIZE_CACHE) && MEGASAS_IS_LOGICAL(scmd)) {
+ scmd->result = DID_OK << 16;
+ goto out_done;
+- default:
+- break;
+ }
+
+ return instance->instancet->build_and_issue_cmd(instance, scmd);
--- /dev/null
+From 4d2b496f19f3c2cfaca1e8fa0710688b5ff3811d Mon Sep 17 00:00:00 2001
+From: "Ewan D. Milne" <emilne@redhat.com>
+Date: Wed, 26 Oct 2016 11:22:53 -0400
+Subject: scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded
+
+From: Ewan D. Milne <emilne@redhat.com>
+
+commit 4d2b496f19f3c2cfaca1e8fa0710688b5ff3811d upstream.
+
+map_storep was not being vfree()'d in the module_exit call.
+
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_debug.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/scsi_debug.c
++++ b/drivers/scsi/scsi_debug.c
+@@ -5134,6 +5134,7 @@ static void __exit scsi_debug_exit(void)
+ bus_unregister(&pseudo_lld_bus);
+ root_device_unregister(pseudo_primary);
+
++ vfree(map_storep);
+ vfree(dif_storep);
+ vfree(fake_storep);
+ kfree(sdebug_q_arr);
input-i8042-add-xmg-c504-to-keyboard-reset-table.patch
firewire-net-guard-against-rx-buffer-overflows.patch
firewire-net-fix-fragmented-datagram_size-off-by-one.patch
+mac80211-discard-multicast-and-4-addr-a-msdus.patch
+revert-ath9k_hw-implement-temperature-compensation-support-for-ar9003.patch
+ath10k-cache-calibration-data-when-the-core-is-stopped.patch
+scsi-megaraid_sas-fix-data-integrity-failure-for-jbod-passthrough-devices.patch
+scsi-scsi_debug-fix-memory-leak-if-lbp-enabled-and-module-is-unloaded.patch
+scsi-arcmsr-send-synchronize_cache-command-to-firmware.patch
+mmc-dw_mmc-pltfm-fix-the-potential-null-pointer-dereference.patch
+raid1-ignore-discard-error.patch
+raid10-ignore-discard-error.patch
+md-be-careful-not-lot-leak-internal-curr_resync-value-into-metadata.-all.patch
+revert-drm-radeon-fix-dp-link-training-issue-with-second-4k-monitor.patch
+drm-imx-ipuv3-plane-switch-eba-buffer-only-when-we-don-t-need-modeset.patch
+drm-imx-ipuv3-plane-access-old-u-vbo-properly-in-atomic_check-for-yu12-yv12.patch
+drm-radeon-si_dpm-limit-clocks-on-hd86xx-part.patch
+drm-radeon-si_dpm-workaround-for-si-kickers.patch
+drm-radeon-drop-register-readback-in-cayman_cp_int_cntl_setup.patch
+drm-nouveau-acpi-fix-check-for-power-resources-support.patch
+drm-fb-helper-don-t-call-dirty-callback-for-untouched-clips.patch
+drm-fb-helper-fix-connector-ref-leak-on-error.patch
+drm-fb-helper-keep-references-for-the-current-set-of-used-connectors.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
