--- /dev/null
+From 753246840d012ae34ea80a1d40bc1546c62fb957 Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Sat, 27 Aug 2016 16:19:49 +0000
+Subject: drivers/perf: arm_pmu: Fix leak in error path
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+commit 753246840d012ae34ea80a1d40bc1546c62fb957 upstream.
+
+In case of a IRQ type mismatch in of_pmu_irq_cfg() the
+device node for interrupt affinity isn't freed. So fix this
+issue by calling of_node_put().
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: fa8ad7889d83 ("arm: perf: factor arm_pmu core out to drivers")
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/perf/arm_pmu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/perf/arm_pmu.c
++++ b/drivers/perf/arm_pmu.c
+@@ -815,6 +815,7 @@ static int of_pmu_irq_cfg(struct arm_pmu
+ if (i > 0 && spi != using_spi) {
+ pr_err("PPI/SPI IRQ type mismatch for %s!\n",
+ dn->name);
++ of_node_put(dn);
+ kfree(irqs);
+ return -EINVAL;
+ }
--- /dev/null
+From cd956722167ba4fdba9c1ce3eed251b04ea2e10f Mon Sep 17 00:00:00 2001
+From: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Date: Tue, 17 May 2016 22:41:33 +0200
+Subject: i40e: avoid null pointer dereference
+
+From: Heinrich Schuchardt <xypron.glpk@gmx.de>
+
+commit cd956722167ba4fdba9c1ce3eed251b04ea2e10f upstream.
+
+In function i40e_debug_aq parameter desc is assumed to be
+possibly NULL. Do not dereference it before checking the
+value.
+
+Fixes: f905dd62be88 ("i40e/i40evf: add max buf len to aq debug print helper")
+Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -302,13 +302,15 @@ void i40e_debug_aq(struct i40e_hw *hw, e
+ void *buffer, u16 buf_len)
+ {
+ struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc;
+- u16 len = le16_to_cpu(aq_desc->datalen);
++ u16 len;
+ u8 *buf = (u8 *)buffer;
+ u16 i = 0;
+
+ if ((!(mask & hw->debug_mask)) || (desc == NULL))
+ return;
+
++ len = le16_to_cpu(aq_desc->datalen);
++
+ i40e_debug(hw, mask,
+ "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 0x%04X\n",
+ le16_to_cpu(aq_desc->opcode),
--- /dev/null
+From 280a3efa82fccc9532c968a77e5162cb9f0af497 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 7 Jun 2016 14:46:37 +0200
+Subject: iwlwifi: mvm: fix a few firmware capability checks
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 280a3efa82fccc9532c968a77e5162cb9f0af497 upstream.
+
+My cleanup in "iwlwifi: prepare for higher API/CAPA bits" accidentally
+inverted a few tests - fix them.
+
+Fixes: 859d914c8f5c ("iwlwifi: prepare for higher API/CAPA bits")
+Reported-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -3992,8 +3992,8 @@ static int iwl_mvm_mac_get_survey(struct
+ if (idx != 0)
+ return -ENOENT;
+
+- if (fw_has_capa(&mvm->fw->ucode_capa,
+- IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
++ if (!fw_has_capa(&mvm->fw->ucode_capa,
++ IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+ return -ENOENT;
+
+ mutex_lock(&mvm->mutex);
+@@ -4039,8 +4039,8 @@ static void iwl_mvm_mac_sta_statistics(s
+ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+
+- if (fw_has_capa(&mvm->fw->ucode_capa,
+- IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
++ if (!fw_has_capa(&mvm->fw->ucode_capa,
++ IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+ return;
+
+ /* if beacon filtering isn't on mac80211 does it anyway */
--- /dev/null
+From 2c81a6477081966fe80b8c6daa68459bca896774 Mon Sep 17 00:00:00 2001
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 14 Jun 2016 16:10:41 +0100
+Subject: perf/core: Fix pmu::filter_match for SW-led groups
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit 2c81a6477081966fe80b8c6daa68459bca896774 upstream.
+
+The following commit:
+
+ 66eb579e66ec ("perf: allow for PMU-specific event filtering")
+
+added the pmu::filter_match() callback. This was intended to
+avoid HW constraints on events from resulting in extremely
+pessimistic scheduling.
+
+However, pmu::filter_match() is only called for the leader of each event
+group. When the leader is a SW event, we do not filter the groups, and
+may fail at pmu::add() time, and when this happens we'll give up on
+scheduling any event groups later in the list until they are rotated
+ahead of the failing group.
+
+This can result in extremely sub-optimal event scheduling behaviour,
+e.g. if running the following on a big.LITTLE platform:
+
+$ taskset -c 0 ./perf stat \
+ -e 'a57{context-switches,armv8_cortex_a57/config=0x11/}' \
+ -e 'a53{context-switches,armv8_cortex_a53/config=0x11/}' \
+ ls
+
+ <not counted> context-switches (0.00%)
+ <not counted> armv8_cortex_a57/config=0x11/ (0.00%)
+ 24 context-switches (37.36%)
+ 57589154 armv8_cortex_a53/config=0x11/ (37.36%)
+
+Here the 'a53' event group was always eligible to be scheduled, but
+the 'a57' group never eligible to be scheduled, as the task was always
+affine to a Cortex-A53 CPU. The SW (group leader) event in the 'a57'
+group was eligible, but the HW event failed at pmu::add() time,
+resulting in ctx_flexible_sched_in giving up on scheduling further
+groups with HW events.
+
+One way of avoiding this is to check pmu::filter_match() on siblings
+as well as the group leader. If any of these fail their
+pmu::filter_match() call, we must skip the entire group before
+attempting to add any events.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will.deacon@arm.com>
+Fixes: 66eb579e66ec ("perf: allow for PMU-specific event filtering")
+Link: http://lkml.kernel.org/r/1465917041-15339-1-git-send-email-mark.rutland@arm.com
+[ Small readability edits. ]
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/core.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1539,12 +1539,33 @@ static int __init perf_workqueue_init(vo
+
+ core_initcall(perf_workqueue_init);
+
+-static inline int pmu_filter_match(struct perf_event *event)
++static inline int __pmu_filter_match(struct perf_event *event)
+ {
+ struct pmu *pmu = event->pmu;
+ return pmu->filter_match ? pmu->filter_match(event) : 1;
+ }
+
++/*
++ * Check whether we should attempt to schedule an event group based on
++ * PMU-specific filtering. An event group can consist of HW and SW events,
++ * potentially with a SW leader, so we must check all the filters, to
++ * determine whether a group is schedulable:
++ */
++static inline int pmu_filter_match(struct perf_event *event)
++{
++ struct perf_event *child;
++
++ if (!__pmu_filter_match(event))
++ return 0;
++
++ list_for_each_entry(child, &event->sibling_list, group_entry) {
++ if (!__pmu_filter_match(child))
++ return 0;
++ }
++
++ return 1;
++}
++
+ static inline int
+ event_filter_match(struct perf_event *event)
+ {
--- /dev/null
+From 7440926ed9623dceca3310c5f437d06c859dc02b Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 21 Jun 2016 01:40:48 +0300
+Subject: pinctrl: Flag strict is a field in struct pinmux_ops
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 7440926ed9623dceca3310c5f437d06c859dc02b upstream.
+
+Documentation incorrectly refers to struct pinctrl_desc, where no such flag is
+available. Replace the name of the struct.
+
+Fixes: commit 8c4c2016345f ("pinctrl: move strict option to pinmux_ops")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/pinctrl.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -831,7 +831,7 @@ separate memory range only intended for
+ range dealing with pin config and pin multiplexing get placed into a
+ different memory range and a separate section of the data sheet.
+
+-A flag "strict" in struct pinctrl_desc is available to check and deny
++A flag "strict" in struct pinmux_ops is available to check and deny
+ simultaneous access to the same pin from GPIO and pin multiplexing
+ consumers on hardware of this type. The pinctrl driver should set this flag
+ accordingly.
--- /dev/null
+From 10ef8277ec658bf6619da9b3fd65c2db7353c2a4 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 31 May 2016 15:30:10 +0900
+Subject: pinctrl: uniphier: fix .pin_dbg_show() callback
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+commit 10ef8277ec658bf6619da9b3fd65c2db7353c2a4 upstream.
+
+Without this, reading the "pins" in the debugfs causes kernel BUG.
+
+Fixes: 6e9088920258 ("pinctrl: UniPhier: add UniPhier pinctrl core support")
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/uniphier/pinctrl-uniphier-core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
++++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
+@@ -73,6 +73,12 @@ static void uniphier_pctl_pin_dbg_show(s
+ case UNIPHIER_PIN_PULL_DOWN:
+ pull_dir = "DOWN";
+ break;
++ case UNIPHIER_PIN_PULL_UP_FIXED:
++ pull_dir = "UP(FIXED)";
++ break;
++ case UNIPHIER_PIN_PULL_DOWN_FIXED:
++ pull_dir = "DOWN(FIXED)";
++ break;
+ case UNIPHIER_PIN_PULL_NONE:
+ pull_dir = "NONE";
+ break;
arm-8617-1-dma-fix-dma_max_pfn.patch
usb-musb-fix-dma-desired-mode-for-mentor-dma-engine.patch
usb-musb-fix-dma-for-host-mode.patch
+iwlwifi-mvm-fix-a-few-firmware-capability-checks.patch
+perf-core-fix-pmu-filter_match-for-sw-led-groups.patch
+i40e-avoid-null-pointer-dereference.patch
+pinctrl-uniphier-fix-.pin_dbg_show-callback.patch
+pinctrl-flag-strict-is-a-field-in-struct-pinmux_ops.patch
+drivers-perf-arm_pmu-fix-leak-in-error-path.patch