--- /dev/null
+From 3497971a71d8b15a41b7bf2bf66ebf5909b2bd3f Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 18 Aug 2016 17:16:41 +0100
+Subject: agp/intel: Flush chipset writes after updating a single PTE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 3497971a71d8b15a41b7bf2bf66ebf5909b2bd3f upstream.
+
+After we update one PTE for a page, the caller expects to be able to
+immediately use that through a GGTT read/write. To comply with the
+callers expectations we therefore need to flush the chipset buffers
+before returning.
+
+Reported-by: Matti Hämäläinen <ccr@tnsp.org>
+Fixes: d6473f566417 ("drm/i915: Add support for mapping an object page...")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Ankitprasad Sharma <ankitprasad.r.sharma@intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Tested-by: Matti Hämäläinen <ccr@tnsp.org>
+Cc: drm-intel-fixes@lists.freedesktop.org
+Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20160818161718.27187-2-chris@chris-wilson.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/agp/intel-gtt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -845,6 +845,8 @@ void intel_gtt_insert_page(dma_addr_t ad
+ unsigned int flags)
+ {
+ intel_private.driver->write_entry(addr, pg, flags);
++ if (intel_private.driver->chipset_flush)
++ intel_private.driver->chipset_flush();
+ }
+ EXPORT_SYMBOL(intel_gtt_insert_page);
+
--- /dev/null
+From 34b89b2967f284937be6759936ef3dc4d3aff2d0 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Sun, 16 Oct 2016 10:45:07 -0300
+Subject: clk: samsung: clk-exynos-audss: Fix module autoload
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+commit 34b89b2967f284937be6759936ef3dc4d3aff2d0 upstream.
+
+If the driver is built as a module, autoload won't work because the module
+alias information is not filled. So user-space can't match the registered
+device with the corresponding module.
+
+Export the module alias information using the MODULE_DEVICE_TABLE() macro.
+
+Before this patch:
+
+$ modinfo drivers/clk/samsung/clk-exynos-audss.ko | grep alias
+alias: platform:exynos-audss-clk
+
+After this patch:
+
+$ modinfo drivers/clk/samsung/clk-exynos-audss.ko | grep alias
+alias: platform:exynos-audss-clk
+alias: of:N*T*Csamsung,exynos5420-audss-clockC*
+alias: of:N*T*Csamsung,exynos5420-audss-clock
+alias: of:N*T*Csamsung,exynos5410-audss-clockC*
+alias: of:N*T*Csamsung,exynos5410-audss-clock
+alias: of:N*T*Csamsung,exynos5250-audss-clockC*
+alias: of:N*T*Csamsung,exynos5250-audss-clock
+alias: of:N*T*Csamsung,exynos4210-audss-clockC*
+alias: of:N*T*Csamsung,exynos4210-audss-clock
+
+Fixes: 4d252fd5719b ("clk: samsung: Allow modular build of the Audio Subsystem CLKCON driver")
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Tested-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/samsung/clk-exynos-audss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/samsung/clk-exynos-audss.c
++++ b/drivers/clk/samsung/clk-exynos-audss.c
+@@ -82,6 +82,7 @@ static const struct of_device_id exynos_
+ .data = (void *)TYPE_EXYNOS5420, },
+ {},
+ };
++MODULE_DEVICE_TABLE(of, exynos_audss_clk_of_match);
+
+ static void exynos_audss_clk_teardown(void)
+ {
--- /dev/null
+From 261d7794c49b9a3bb5115c5ffc452e00f969bf43 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 4 Oct 2016 11:50:54 -0700
+Subject: Input: synaptics-rmi4 - fix error handling in I2C transport driver
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 261d7794c49b9a3bb5115c5ffc452e00f969bf43 upstream.
+
+Instantiating the rmi4 I2C transport driver without interrupts assigned
+(for example using manual i2c instantiation from the command line)
+caused the driver to fail to load, but it does not clean up its regulator
+or transport device registrations. Result is a crash at a later time,
+for example when rebooting the system.
+
+Fixes: 946c8432aab0 ("Input: synaptics-rmi4 - support regulator supplies")
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/rmi4/rmi_i2c.c | 38 ++++++++++++++++++++++++++------------
+ 1 file changed, 26 insertions(+), 12 deletions(-)
+
+--- a/drivers/input/rmi4/rmi_i2c.c
++++ b/drivers/input/rmi4/rmi_i2c.c
+@@ -221,6 +221,21 @@ static const struct of_device_id rmi_i2c
+ MODULE_DEVICE_TABLE(of, rmi_i2c_of_match);
+ #endif
+
++static void rmi_i2c_regulator_bulk_disable(void *data)
++{
++ struct rmi_i2c_xport *rmi_i2c = data;
++
++ regulator_bulk_disable(ARRAY_SIZE(rmi_i2c->supplies),
++ rmi_i2c->supplies);
++}
++
++static void rmi_i2c_unregister_transport(void *data)
++{
++ struct rmi_i2c_xport *rmi_i2c = data;
++
++ rmi_unregister_transport_device(&rmi_i2c->xport);
++}
++
+ static int rmi_i2c_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+@@ -264,6 +279,12 @@ static int rmi_i2c_probe(struct i2c_clie
+ if (retval < 0)
+ return retval;
+
++ retval = devm_add_action_or_reset(&client->dev,
++ rmi_i2c_regulator_bulk_disable,
++ rmi_i2c);
++ if (retval)
++ return retval;
++
+ of_property_read_u32(client->dev.of_node, "syna,startup-delay-ms",
+ &rmi_i2c->startup_delay);
+
+@@ -294,6 +315,11 @@ static int rmi_i2c_probe(struct i2c_clie
+ client->addr);
+ return retval;
+ }
++ retval = devm_add_action_or_reset(&client->dev,
++ rmi_i2c_unregister_transport,
++ rmi_i2c);
++ if (retval)
++ return retval;
+
+ retval = rmi_i2c_init_irq(client);
+ if (retval < 0)
+@@ -304,17 +330,6 @@ static int rmi_i2c_probe(struct i2c_clie
+ return 0;
+ }
+
+-static int rmi_i2c_remove(struct i2c_client *client)
+-{
+- struct rmi_i2c_xport *rmi_i2c = i2c_get_clientdata(client);
+-
+- rmi_unregister_transport_device(&rmi_i2c->xport);
+- regulator_bulk_disable(ARRAY_SIZE(rmi_i2c->supplies),
+- rmi_i2c->supplies);
+-
+- return 0;
+-}
+-
+ #ifdef CONFIG_PM_SLEEP
+ static int rmi_i2c_suspend(struct device *dev)
+ {
+@@ -431,7 +446,6 @@ static struct i2c_driver rmi_i2c_driver
+ },
+ .id_table = rmi_id,
+ .probe = rmi_i2c_probe,
+- .remove = rmi_i2c_remove,
+ };
+
+ module_i2c_driver(rmi_i2c_driver);
--- /dev/null
+From bbc2ceeb3220e54c7574f0b5e3a252fd9a62cf8a Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 4 Oct 2016 11:48:55 -0700
+Subject: Input: synaptics-rmi4 - fix error handling in SPI transport driver
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit bbc2ceeb3220e54c7574f0b5e3a252fd9a62cf8a upstream.
+
+Instantiating the rmi4 SPI transport driver without an interrupt assigned
+caused the driver to fail to load, but it does not clean up its transport
+device registration. Result may be a crash at a later time, for example
+when rebooting the system.
+
+Fixes: 8d99758dee31 ("Input: synaptics-rmi4 - add SPI transport driver")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/rmi4/rmi_spi.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+--- a/drivers/input/rmi4/rmi_spi.c
++++ b/drivers/input/rmi4/rmi_spi.c
+@@ -396,6 +396,13 @@ static inline int rmi_spi_of_probe(struc
+ }
+ #endif
+
++static void rmi_spi_unregister_transport(void *data)
++{
++ struct rmi_spi_xport *rmi_spi = data;
++
++ rmi_unregister_transport_device(&rmi_spi->xport);
++}
++
+ static int rmi_spi_probe(struct spi_device *spi)
+ {
+ struct rmi_spi_xport *rmi_spi;
+@@ -464,6 +471,11 @@ static int rmi_spi_probe(struct spi_devi
+ dev_err(&spi->dev, "failed to register transport.\n");
+ return retval;
+ }
++ retval = devm_add_action_or_reset(&spi->dev,
++ rmi_spi_unregister_transport,
++ rmi_spi);
++ if (retval)
++ return retval;
+
+ retval = rmi_spi_init_irq(spi);
+ if (retval < 0)
+@@ -473,15 +485,6 @@ static int rmi_spi_probe(struct spi_devi
+ return 0;
+ }
+
+-static int rmi_spi_remove(struct spi_device *spi)
+-{
+- struct rmi_spi_xport *rmi_spi = spi_get_drvdata(spi);
+-
+- rmi_unregister_transport_device(&rmi_spi->xport);
+-
+- return 0;
+-}
+-
+ #ifdef CONFIG_PM_SLEEP
+ static int rmi_spi_suspend(struct device *dev)
+ {
+@@ -577,7 +580,6 @@ static struct spi_driver rmi_spi_driver
+ },
+ .id_table = rmi_id,
+ .probe = rmi_spi_probe,
+- .remove = rmi_spi_remove,
+ };
+
+ module_spi_driver(rmi_spi_driver);
--- /dev/null
+From c3db901c54466a9c135d1e6e95fec452e8a42666 Mon Sep 17 00:00:00 2001
+From: Baoquan He <bhe@redhat.com>
+Date: Thu, 15 Sep 2016 16:50:52 +0800
+Subject: iommu/amd: Free domain id when free a domain of struct dma_ops_domain
+
+From: Baoquan He <bhe@redhat.com>
+
+commit c3db901c54466a9c135d1e6e95fec452e8a42666 upstream.
+
+The current code missed freeing domain id when free a domain of
+struct dma_ops_domain.
+
+Signed-off-by: Baoquan He <bhe@redhat.com>
+Fixes: ec487d1a110a ('x86, AMD IOMMU: add domain allocation and deallocation functions')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1654,6 +1654,9 @@ static void dma_ops_domain_free(struct d
+
+ free_pagetable(&dom->domain);
+
++ if (dom->domain.id)
++ domain_id_free(dom->domain.id);
++
+ kfree(dom);
+ }
+
--- /dev/null
+From 82db33dc5e49fb625262d81125625d07a0d6184e Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Tue, 13 Sep 2016 18:02:02 +0100
+Subject: iommu/io-pgtable-arm: Check for v7s-incapable systems
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+commit 82db33dc5e49fb625262d81125625d07a0d6184e upstream.
+
+On machines with no 32-bit addressable RAM whatsoever, we shouldn't
+even touch the v7s format as it's never going to work.
+
+Fixes: e5fc9753b1a8 ("iommu/io-pgtable: Add ARMv7 short descriptor support")
+Reported-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/io-pgtable-arm-v7s.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/iommu/io-pgtable-arm-v7s.c
++++ b/drivers/iommu/io-pgtable-arm-v7s.c
+@@ -633,6 +633,10 @@ static struct io_pgtable *arm_v7s_alloc_
+ {
+ struct arm_v7s_io_pgtable *data;
+
++#ifdef PHYS_OFFSET
++ if (upper_32_bits(PHYS_OFFSET))
++ return NULL;
++#endif
+ if (cfg->ias > ARM_V7S_ADDR_BITS || cfg->oas > ARM_V7S_ADDR_BITS)
+ return NULL;
+
--- /dev/null
+From bea64033dd7b5fb6296eda8266acab6364ce1554 Mon Sep 17 00:00:00 2001
+From: Joerg Roedel <jroedel@suse.de>
+Date: Tue, 8 Nov 2016 15:08:26 +0100
+Subject: iommu/vt-d: Fix dead-locks in disable_dmar_iommu() path
+
+From: Joerg Roedel <jroedel@suse.de>
+
+commit bea64033dd7b5fb6296eda8266acab6364ce1554 upstream.
+
+It turns out that the disable_dmar_iommu() code-path tried
+to get the device_domain_lock recursivly, which will
+dead-lock when this code runs on dmar removal. Fix both
+code-paths that could lead to the dead-lock.
+
+Fixes: 55d940430ab9 ('iommu/vt-d: Get rid of domain->iommu_lock')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1711,6 +1711,7 @@ static void disable_dmar_iommu(struct in
+ if (!iommu->domains || !iommu->domain_ids)
+ return;
+
++again:
+ spin_lock_irqsave(&device_domain_lock, flags);
+ list_for_each_entry_safe(info, tmp, &device_domain_list, global) {
+ struct dmar_domain *domain;
+@@ -1723,10 +1724,19 @@ static void disable_dmar_iommu(struct in
+
+ domain = info->domain;
+
+- dmar_remove_one_dev_info(domain, info->dev);
++ __dmar_remove_one_dev_info(info);
+
+- if (!domain_type_is_vm_or_si(domain))
++ if (!domain_type_is_vm_or_si(domain)) {
++ /*
++ * The domain_exit() function can't be called under
++ * device_domain_lock, as it takes this lock itself.
++ * So release the lock here and re-run the loop
++ * afterwards.
++ */
++ spin_unlock_irqrestore(&device_domain_lock, flags);
+ domain_exit(domain);
++ goto again;
++ }
+ }
+ spin_unlock_irqrestore(&device_domain_lock, flags);
+
--- /dev/null
+From 582ab27a063a506ccb55fc48afcc325342a2deba Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Mon, 31 Oct 2016 19:02:39 +0200
+Subject: mei: bus: fix received data size check in NFC fixup
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 582ab27a063a506ccb55fc48afcc325342a2deba upstream.
+
+NFC version reply size checked against only header size, not against
+full message size. That may lead potentially to uninitialized memory access
+in version data.
+
+That leads to warnings when version data is accessed:
+drivers/misc/mei/bus-fixup.c: warning: '*((void *)&ver+11)' may be used uninitialized in this function [-Wuninitialized]: => 212:2
+
+Reported in
+Build regressions/improvements in v4.9-rc3
+https://lkml.org/lkml/2016/10/30/57
+
+Fixes: 59fcd7c63abf (mei: nfc: Initial nfc implementation)
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/mei/bus-fixup.c | 2 +-
+ drivers/nfc/mei_phy.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/mei/bus-fixup.c
++++ b/drivers/misc/mei/bus-fixup.c
+@@ -178,7 +178,7 @@ static int mei_nfc_if_version(struct mei
+
+ ret = 0;
+ bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length);
+- if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
++ if (bytes_recv < if_version_length) {
+ dev_err(bus->dev, "Could not read IF version\n");
+ ret = -EIO;
+ goto err;
+--- a/drivers/nfc/mei_phy.c
++++ b/drivers/nfc/mei_phy.c
+@@ -133,7 +133,7 @@ static int mei_nfc_if_version(struct nfc
+ return -ENOMEM;
+
+ bytes_recv = mei_cldev_recv(phy->cldev, (u8 *)reply, if_version_length);
+- if (bytes_recv < 0 || bytes_recv < sizeof(struct mei_nfc_reply)) {
++ if (bytes_recv < 0 || bytes_recv < if_version_length) {
+ pr_err("Could not read IF version\n");
+ r = -EIO;
+ goto err;
--- /dev/null
+From 7065906096273b39b90a512a7170a6697ed94b23 Mon Sep 17 00:00:00 2001
+From: Keith Busch <keith.busch@intel.com>
+Date: Wed, 12 Oct 2016 09:22:16 -0600
+Subject: nvme: Delete created IO queues on reset
+
+From: Keith Busch <keith.busch@intel.com>
+
+commit 7065906096273b39b90a512a7170a6697ed94b23 upstream.
+
+The driver was decrementing the online_queues prior to attempting to
+delete those IO queues, so the driver ended up not requesting the
+controller delete any. This patch saves the online_queues prior to
+suspending them, and adds that parameter for deleting io queues.
+
+Fixes: c21377f8 ("nvme: Suspend all queues before deletion")
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/host/pci.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1531,9 +1531,9 @@ static int nvme_delete_queue(struct nvme
+ return 0;
+ }
+
+-static void nvme_disable_io_queues(struct nvme_dev *dev)
++static void nvme_disable_io_queues(struct nvme_dev *dev, int queues)
+ {
+- int pass, queues = dev->online_queues - 1;
++ int pass;
+ unsigned long timeout;
+ u8 opcode = nvme_admin_delete_sq;
+
+@@ -1678,7 +1678,7 @@ static void nvme_pci_disable(struct nvme
+
+ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
+ {
+- int i;
++ int i, queues;
+ u32 csts = -1;
+
+ del_timer_sync(&dev->watchdog_timer);
+@@ -1689,6 +1689,7 @@ static void nvme_dev_disable(struct nvme
+ csts = readl(dev->bar + NVME_REG_CSTS);
+ }
+
++ queues = dev->online_queues - 1;
+ for (i = dev->queue_count - 1; i > 0; i--)
+ nvme_suspend_queue(dev->queues[i]);
+
+@@ -1700,7 +1701,7 @@ static void nvme_dev_disable(struct nvme
+ if (dev->queue_count)
+ nvme_suspend_queue(dev->queues[0]);
+ } else {
+- nvme_disable_io_queues(dev);
++ nvme_disable_io_queues(dev, queues);
+ nvme_disable_admin_queue(dev, shutdown);
+ }
+ nvme_pci_disable(dev);
--- /dev/null
+From c611152373e84a7677cd7d496e849de4debdab66 Mon Sep 17 00:00:00 2001
+From: Namhyung Kim <namhyung@kernel.org>
+Date: Fri, 7 Oct 2016 14:04:12 +0900
+Subject: perf top: Fix refreshing hierarchy entries on TUI
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+commit c611152373e84a7677cd7d496e849de4debdab66 upstream.
+
+Markus reported that 'perf top --hierarchy' cannot scroll down after
+refresh. This was because the number of entries are not updated when
+hierarchy is enabled.
+
+Unlike normal report view, hierarchy mode needs to keep its own entry
+count since it can have non-leaf entries which can expand/collapse.
+
+Reported-and-Tested-by: Markus Trippelsdorf <markus@trippelsdorf.de>
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Fixes: f5b763feebe9 ("perf hists browser: Count number of hierarchy entries")
+Link: http://lkml.kernel.org/r/20161007050412.3000-1-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/ui/browsers/hists.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -595,7 +595,8 @@ int hist_browser__run(struct hist_browse
+ u64 nr_entries;
+ hbt->timer(hbt->arg);
+
+- if (hist_browser__has_filter(browser))
++ if (hist_browser__has_filter(browser) ||
++ symbol_conf.report_hierarchy)
+ hist_browser__update_nr_entries(browser);
+
+ nr_entries = hist_browser__nr_entries(browser);
--- /dev/null
+From 593876838826914a7e4e05fbbcb728be6fbc4d89 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Tue, 18 Oct 2016 13:49:18 +0800
+Subject: Revert "clocksource/drivers/timer_sun5i: Replace code by clocksource_mmio_init"
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 593876838826914a7e4e05fbbcb728be6fbc4d89 upstream.
+
+struct clocksource is also used by the clk notifier callback, to
+unregister and re-register the clocksource with a different clock rate.
+clocksource_mmio_init does not pass back a pointer to the struct used,
+and the clk notifier callback assumes that the struct clocksource in
+struct sun5i_timer_clksrc is valid. This results in a kernel NULL
+pointer dereference when the hstimer clock is changed:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000004
+[<c03a4678>] (clocksource_unbind) from [<c03a46d4>] (clocksource_unregister+0x2c/0x44)
+[<c03a46d4>] (clocksource_unregister) from [<c0a6f350>] (sun5i_rate_cb_clksrc+0x34/0x3c)
+[<c0a6f350>] (sun5i_rate_cb_clksrc) from [<c035ea50>] (notifier_call_chain+0x44/0x84)
+[<c035ea50>] (notifier_call_chain) from [<c035edc0>] (__srcu_notifier_call_chain+0x44/0x60)
+[<c035edc0>] (__srcu_notifier_call_chain) from [<c035edf4>] (srcu_notifier_call_chain+0x18/0x20)
+[<c035edf4>] (srcu_notifier_call_chain) from [<c0670174>] (__clk_notify+0x70/0x7c)
+[<c0670174>] (__clk_notify) from [<c06702c0>] (clk_propagate_rate_change+0xa4/0xc4)
+[<c06702c0>] (clk_propagate_rate_change) from [<c0670288>] (clk_propagate_rate_change+0x6c/0xc4)
+
+Revert the commit for now. clocksource_mmio_init can be made to pass back
+a pointer, but the code churn and usage of an inner struct might not be
+worth it.
+
+Fixes: 157dfadef832 ("clocksource/drivers/timer_sun5i: Replace code by clocksource_mmio_init")
+Reported-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Cc: linux-sunxi@googlegroups.com
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: http://lkml.kernel.org/r/20161018054918.26855-1-wens@csie.org
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clocksource/timer-sun5i.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -152,6 +152,13 @@ static irqreturn_t sun5i_timer_interrupt
+ return IRQ_HANDLED;
+ }
+
++static cycle_t sun5i_clksrc_read(struct clocksource *clksrc)
++{
++ struct sun5i_timer_clksrc *cs = to_sun5i_timer_clksrc(clksrc);
++
++ return ~readl(cs->timer.base + TIMER_CNTVAL_LO_REG(1));
++}
++
+ static int sun5i_rate_cb_clksrc(struct notifier_block *nb,
+ unsigned long event, void *data)
+ {
+@@ -210,8 +217,13 @@ static int __init sun5i_setup_clocksourc
+ writel(TIMER_CTL_ENABLE | TIMER_CTL_RELOAD,
+ base + TIMER_CTL_REG(1));
+
+- ret = clocksource_mmio_init(base + TIMER_CNTVAL_LO_REG(1), node->name,
+- rate, 340, 32, clocksource_mmio_readl_down);
++ cs->clksrc.name = node->name;
++ cs->clksrc.rating = 340;
++ cs->clksrc.read = sun5i_clksrc_read;
++ cs->clksrc.mask = CLOCKSOURCE_MASK(32);
++ cs->clksrc.flags = CLOCK_SOURCE_IS_CONTINUOUS;
++
++ ret = clocksource_register_hz(&cs->clksrc, rate);
+ if (ret) {
+ pr_err("Couldn't register clock source.\n");
+ goto err_remove_notifier;
drm-amd-fix-scheduler-fence-teardown-order-v2.patch
xprtrdma-use-complete-instead-complete_all.patch
xprtrdma-fix-dmar-failure-in-frwr_op_map-after-reconnect.patch
+iommu-io-pgtable-arm-check-for-v7s-incapable-systems.patch
+iommu-amd-free-domain-id-when-free-a-domain-of-struct-dma_ops_domain.patch
+iommu-vt-d-fix-dead-locks-in-disable_dmar_iommu-path.patch
+agp-intel-flush-chipset-writes-after-updating-a-single-pte.patch
+watchdog-core-fix-devres_alloc-allocation-size.patch
+input-synaptics-rmi4-fix-error-handling-in-spi-transport-driver.patch
+input-synaptics-rmi4-fix-error-handling-in-i2c-transport-driver.patch
+perf-top-fix-refreshing-hierarchy-entries-on-tui.patch
+mei-bus-fix-received-data-size-check-in-nfc-fixup.patch
+svcrdma-skip-put_page-when-send_reply-fails.patch
+svcrdma-tail-iovec-leaves-an-orphaned-dma-mapping.patch
+nvme-delete-created-io-queues-on-reset.patch
+revert-clocksource-drivers-timer_sun5i-replace-code-by-clocksource_mmio_init.patch
+x86-build-fix-build-with-older-gcc-versions.patch
+clk-samsung-clk-exynos-audss-fix-module-autoload.patch
--- /dev/null
+From 9995237bba702281e0e8e677edd5bb225f4f6c30 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Tue, 13 Sep 2016 10:52:59 -0400
+Subject: svcrdma: Skip put_page() when send_reply() fails
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 9995237bba702281e0e8e677edd5bb225f4f6c30 upstream.
+
+Message from syslogd@klimt at Aug 18 17:00:37 ...
+ kernel:page:ffffea0020639b00 count:0 mapcount:0 mapping: (null) index:0x0
+Aug 18 17:00:37 klimt kernel: flags: 0x2fffff80000000()
+Aug 18 17:00:37 klimt kernel: page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
+
+Aug 18 17:00:37 klimt kernel: kernel BUG at /home/cel/src/linux/linux-2.6/include/linux/mm.h:445!
+Aug 18 17:00:37 klimt kernel: RIP: 0010:[<ffffffffa05c21c1>] svc_rdma_sendto+0x641/0x820 [rpcrdma]
+
+send_reply() assigns its page argument as the first page of ctxt. On
+error, send_reply() already invokes svc_rdma_put_context(ctxt, 1);
+which does a put_page() on that very page. No need to do that again
+as svc_rdma_sendto exits.
+
+Fixes: 3e1eeb980822 ("svcrdma: Close connection when a send error occurs")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xprtrdma/svc_rdma_sendto.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+@@ -635,7 +635,7 @@ int svc_rdma_sendto(struct svc_rqst *rqs
+ ret = send_reply(rdma, rqstp, res_page, rdma_resp, vec,
+ inline_bytes);
+ if (ret < 0)
+- goto err1;
++ goto err0;
+
+ svc_rdma_put_req_map(rdma, vec);
+ dprintk("svcrdma: send_reply returns %d\n", ret);
--- /dev/null
+From cace564f8b6260e806f5e28d7f192fd0e0c603ed Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Tue, 13 Sep 2016 10:52:50 -0400
+Subject: svcrdma: Tail iovec leaves an orphaned DMA mapping
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit cace564f8b6260e806f5e28d7f192fd0e0c603ed upstream.
+
+The ctxt's count field is overloaded to mean the number of pages in
+the ctxt->page array and the number of SGEs in the ctxt->sge array.
+Typically these two numbers are the same.
+
+However, when an inline RPC reply is constructed from an xdr_buf
+with a tail iovec, the head and tail often occupy the same page,
+but each are DMA mapped independently. In that case, ->count equals
+the number of pages, but it does not equal the number of SGEs.
+There's one more SGE, for the tail iovec. Hence there is one more
+DMA mapping than there are pages in the ctxt->page array.
+
+This isn't a real problem until the server's iommu is enabled. Then
+each RPC reply that has content in that iovec orphans a DMA mapping
+that consists of real resources.
+
+krb5i and krb5p always populate that tail iovec. After a couple
+million sent krb5i/p RPC replies, the NFS server starts behaving
+erratically. Reboot is needed to clear the problem.
+
+Fixes: 9d11b51ce7c1 ("svcrdma: Fix send_reply() scatter/gather set-up")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/sunrpc/svc_rdma.h | 9 +++++++++
+ net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 2 +-
+ net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 2 +-
+ net/sunrpc/xprtrdma/svc_rdma_sendto.c | 22 ++++------------------
+ net/sunrpc/xprtrdma/svc_rdma_transport.c | 18 ++++++++++++------
+ 5 files changed, 27 insertions(+), 26 deletions(-)
+
+--- a/include/linux/sunrpc/svc_rdma.h
++++ b/include/linux/sunrpc/svc_rdma.h
+@@ -86,6 +86,7 @@ struct svc_rdma_op_ctxt {
+ unsigned long flags;
+ enum dma_data_direction direction;
+ int count;
++ unsigned int mapped_sges;
+ struct ib_sge sge[RPCSVC_MAXPAGES];
+ struct page *pages[RPCSVC_MAXPAGES];
+ };
+@@ -193,6 +194,14 @@ struct svcxprt_rdma {
+
+ #define RPCSVC_MAXPAYLOAD_RDMA RPCSVC_MAXPAYLOAD
+
++/* Track DMA maps for this transport and context */
++static inline void svc_rdma_count_mappings(struct svcxprt_rdma *rdma,
++ struct svc_rdma_op_ctxt *ctxt)
++{
++ ctxt->mapped_sges++;
++ atomic_inc(&rdma->sc_dma_used);
++}
++
+ /* svc_rdma_backchannel.c */
+ extern int svc_rdma_handle_bc_reply(struct rpc_xprt *xprt,
+ struct rpcrdma_msg *rmsgp,
+--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c
+@@ -129,7 +129,7 @@ static int svc_rdma_bc_sendto(struct svc
+ ret = -EIO;
+ goto out_unmap;
+ }
+- atomic_inc(&rdma->sc_dma_used);
++ svc_rdma_count_mappings(rdma, ctxt);
+
+ memset(&send_wr, 0, sizeof(send_wr));
+ ctxt->cqe.done = svc_rdma_wc_send;
+--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+@@ -159,7 +159,7 @@ int rdma_read_chunk_lcl(struct svcxprt_r
+ ctxt->sge[pno].addr);
+ if (ret)
+ goto err;
+- atomic_inc(&xprt->sc_dma_used);
++ svc_rdma_count_mappings(xprt, ctxt);
+
+ ctxt->sge[pno].lkey = xprt->sc_pd->local_dma_lkey;
+ ctxt->sge[pno].length = len;
+--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+@@ -280,7 +280,7 @@ static int send_write(struct svcxprt_rdm
+ if (ib_dma_mapping_error(xprt->sc_cm_id->device,
+ sge[sge_no].addr))
+ goto err;
+- atomic_inc(&xprt->sc_dma_used);
++ svc_rdma_count_mappings(xprt, ctxt);
+ sge[sge_no].lkey = xprt->sc_pd->local_dma_lkey;
+ ctxt->count++;
+ sge_off = 0;
+@@ -489,7 +489,7 @@ static int send_reply(struct svcxprt_rdm
+ ctxt->sge[0].length, DMA_TO_DEVICE);
+ if (ib_dma_mapping_error(rdma->sc_cm_id->device, ctxt->sge[0].addr))
+ goto err;
+- atomic_inc(&rdma->sc_dma_used);
++ svc_rdma_count_mappings(rdma, ctxt);
+
+ ctxt->direction = DMA_TO_DEVICE;
+
+@@ -505,7 +505,7 @@ static int send_reply(struct svcxprt_rdm
+ if (ib_dma_mapping_error(rdma->sc_cm_id->device,
+ ctxt->sge[sge_no].addr))
+ goto err;
+- atomic_inc(&rdma->sc_dma_used);
++ svc_rdma_count_mappings(rdma, ctxt);
+ ctxt->sge[sge_no].lkey = rdma->sc_pd->local_dma_lkey;
+ ctxt->sge[sge_no].length = sge_bytes;
+ }
+@@ -523,23 +523,9 @@ static int send_reply(struct svcxprt_rdm
+ ctxt->pages[page_no+1] = rqstp->rq_respages[page_no];
+ ctxt->count++;
+ rqstp->rq_respages[page_no] = NULL;
+- /*
+- * If there are more pages than SGE, terminate SGE
+- * list so that svc_rdma_unmap_dma doesn't attempt to
+- * unmap garbage.
+- */
+- if (page_no+1 >= sge_no)
+- ctxt->sge[page_no+1].length = 0;
+ }
+ rqstp->rq_next_page = rqstp->rq_respages + 1;
+
+- /* The loop above bumps sc_dma_used for each sge. The
+- * xdr_buf.tail gets a separate sge, but resides in the
+- * same page as xdr_buf.head. Don't count it twice.
+- */
+- if (sge_no > ctxt->count)
+- atomic_dec(&rdma->sc_dma_used);
+-
+ if (sge_no > rdma->sc_max_sge) {
+ pr_err("svcrdma: Too many sges (%d)\n", sge_no);
+ goto err;
+@@ -692,7 +678,7 @@ void svc_rdma_send_error(struct svcxprt_
+ svc_rdma_put_context(ctxt, 1);
+ return;
+ }
+- atomic_inc(&xprt->sc_dma_used);
++ svc_rdma_count_mappings(xprt, ctxt);
+
+ /* Prepare SEND WR */
+ memset(&err_wr, 0, sizeof(err_wr));
+--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+@@ -198,6 +198,7 @@ struct svc_rdma_op_ctxt *svc_rdma_get_co
+
+ out:
+ ctxt->count = 0;
++ ctxt->mapped_sges = 0;
+ ctxt->frmr = NULL;
+ return ctxt;
+
+@@ -221,22 +222,27 @@ out_empty:
+ void svc_rdma_unmap_dma(struct svc_rdma_op_ctxt *ctxt)
+ {
+ struct svcxprt_rdma *xprt = ctxt->xprt;
+- int i;
+- for (i = 0; i < ctxt->count && ctxt->sge[i].length; i++) {
++ struct ib_device *device = xprt->sc_cm_id->device;
++ u32 lkey = xprt->sc_pd->local_dma_lkey;
++ unsigned int i, count;
++
++ for (count = 0, i = 0; i < ctxt->mapped_sges; i++) {
+ /*
+ * Unmap the DMA addr in the SGE if the lkey matches
+ * the local_dma_lkey, otherwise, ignore it since it is
+ * an FRMR lkey and will be unmapped later when the
+ * last WR that uses it completes.
+ */
+- if (ctxt->sge[i].lkey == xprt->sc_pd->local_dma_lkey) {
+- atomic_dec(&xprt->sc_dma_used);
+- ib_dma_unmap_page(xprt->sc_cm_id->device,
++ if (ctxt->sge[i].lkey == lkey) {
++ count++;
++ ib_dma_unmap_page(device,
+ ctxt->sge[i].addr,
+ ctxt->sge[i].length,
+ ctxt->direction);
+ }
+ }
++ ctxt->mapped_sges = 0;
++ atomic_sub(count, &xprt->sc_dma_used);
+ }
+
+ void svc_rdma_put_context(struct svc_rdma_op_ctxt *ctxt, int free_pages)
+@@ -600,7 +606,7 @@ int svc_rdma_post_recv(struct svcxprt_rd
+ DMA_FROM_DEVICE);
+ if (ib_dma_mapping_error(xprt->sc_cm_id->device, pa))
+ goto err_put_ctxt;
+- atomic_inc(&xprt->sc_dma_used);
++ svc_rdma_count_mappings(xprt, ctxt);
+ ctxt->sge[sge_no].addr = pa;
+ ctxt->sge[sge_no].length = PAGE_SIZE;
+ ctxt->sge[sge_no].lkey = xprt->sc_pd->local_dma_lkey;
--- /dev/null
+From 2e91838bf7ffdedabdb29e091207d6531d04ef4f Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 9 Aug 2016 22:34:31 -0700
+Subject: watchdog: core: Fix devres_alloc() allocation size
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 2e91838bf7ffdedabdb29e091207d6531d04ef4f upstream.
+
+Coverity reports:
+
+Passing argument 152UL /* sizeof (*wdd) */ to function __devres_alloc_node
+and then casting the return value to struct watchdog_device ** is
+suspicious.
+
+Allocation size needs to be sizeof(*rcwdd), not sizeof(*wdd).
+
+Fixes: 83fbae5a148c ("watchdog: Add a device managed API for ...")
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/watchdog/watchdog_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/watchdog_core.c
++++ b/drivers/watchdog/watchdog_core.c
+@@ -349,7 +349,7 @@ int devm_watchdog_register_device(struct
+ struct watchdog_device **rcwdd;
+ int ret;
+
+- rcwdd = devres_alloc(devm_watchdog_unregister_device, sizeof(*wdd),
++ rcwdd = devres_alloc(devm_watchdog_unregister_device, sizeof(*rcwdd),
+ GFP_KERNEL);
+ if (!rcwdd)
+ return -ENOMEM;
--- /dev/null
+From a2209b742e6cf978b85d4f31a25a269c3d3b062b Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@suse.com>
+Date: Mon, 24 Oct 2016 09:00:12 -0600
+Subject: x86/build: Fix build with older GCC versions
+
+From: Jan Beulich <JBeulich@suse.com>
+
+commit a2209b742e6cf978b85d4f31a25a269c3d3b062b upstream.
+
+Older GCC (observed with 4.1.x) doesn't support -Wno-override-init and
+also doesn't ignore unknown -Wno-* options.
+
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Cc: Valdis.Kletnieks@vt.edu
+Fixes: 5e44258d16 "x86/build: Reduce the W=1 warnings noise when compiling x86 syscall tables"
+Link: http://lkml.kernel.org/r/580E3E1C02000078001191C4@prv-mh.provo.novell.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/entry/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/entry/Makefile
++++ b/arch/x86/entry/Makefile
+@@ -5,8 +5,8 @@
+ OBJECT_FILES_NON_STANDARD_entry_$(BITS).o := y
+ OBJECT_FILES_NON_STANDARD_entry_64_compat.o := y
+
+-CFLAGS_syscall_64.o += -Wno-override-init
+-CFLAGS_syscall_32.o += -Wno-override-init
++CFLAGS_syscall_64.o += $(call cc-option,-Wno-override-init,)
++CFLAGS_syscall_32.o += $(call cc-option,-Wno-override-init,)
+ obj-y := entry_$(BITS).o thunk_$(BITS).o syscall_$(BITS).o
+ obj-y += common.o
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
