--- /dev/null
+From 1b1f3e1699a9886f1070f94171097ab4ccdbfc95 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 1 Jan 2015 23:38:28 +0100
+Subject: ACPI / PM: Fix PM initialization for devices that are not present
+
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+
+commit 1b1f3e1699a9886f1070f94171097ab4ccdbfc95 upstream.
+
+If an ACPI device object whose _STA returns 0 (not present and not
+functional) has _PR0 or _PS0, its power_manageable flag will be set
+and acpi_bus_init_power() will return 0 for it. Consequently, if
+such a device object is passed to the ACPI device PM functions, they
+will attempt to carry out the requested operation on the device,
+although they should not do that for devices that are not present.
+
+To fix that problem make acpi_bus_init_power() return an error code
+for devices that are not present which will cause power_manageable to
+be cleared for them as appropriate in acpi_bus_get_power_flags().
+However, the lists of power resources should not be freed for the
+device in that case, so modify acpi_bus_get_power_flags() to keep
+those lists even if acpi_bus_init_power() returns an error.
+Accordingly, when deciding whether or not the lists of power
+resources need to be freed, acpi_free_power_resources_lists()
+should check the power.flags.power_resources flag instead of
+flags.power_manageable, so make that change too.
+
+Furthermore, if acpi_bus_attach() sees that flags.initialized is
+unset for the given device, it should reset the power management
+settings of the device and re-initialize them from scratch instead
+of relying on the previous settings (the device may have appeared
+after being not present previously, for example), so make it use
+the 'valid' flag of the D0 power state as the initial value of
+flags.power_manageable for it and call acpi_bus_init_power() to
+discover its current power state.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/device_pm.c | 2 +-
+ drivers/acpi/scan.c | 13 ++++++++-----
+ 2 files changed, 9 insertions(+), 6 deletions(-)
+
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -257,7 +257,7 @@ int acpi_bus_init_power(struct acpi_devi
+
+ device->power.state = ACPI_STATE_UNKNOWN;
+ if (!acpi_device_is_present(device))
+- return 0;
++ return -ENXIO;
+
+ result = acpi_device_get_power(device, &state);
+ if (result)
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -909,7 +909,7 @@ static void acpi_free_power_resources_li
+ if (device->wakeup.flags.valid)
+ acpi_power_resources_list_free(&device->wakeup.resources);
+
+- if (!device->flags.power_manageable)
++ if (!device->power.flags.power_resources)
+ return;
+
+ for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) {
+@@ -1631,10 +1631,8 @@ static void acpi_bus_get_power_flags(str
+ device->power.flags.power_resources)
+ device->power.states[ACPI_STATE_D3_COLD].flags.os_accessible = 1;
+
+- if (acpi_bus_init_power(device)) {
+- acpi_free_power_resources_lists(device);
++ if (acpi_bus_init_power(device))
+ device->flags.power_manageable = 0;
+- }
+ }
+
+ static void acpi_bus_get_flags(struct acpi_device *device)
+@@ -2202,13 +2200,18 @@ static void acpi_bus_attach(struct acpi_
+ /* Skip devices that are not present. */
+ if (!acpi_device_is_present(device)) {
+ device->flags.visited = false;
++ device->flags.power_manageable = 0;
+ return;
+ }
+ if (device->handler)
+ goto ok;
+
+ if (!device->flags.initialized) {
+- acpi_bus_update_power(device, NULL);
++ device->flags.power_manageable =
++ device->power.states[ACPI_STATE_D0].flags.valid;
++ if (acpi_bus_init_power(device))
++ device->flags.power_manageable = 0;
++
+ device->flags.initialized = true;
+ }
+ device->flags.visited = false;
--- /dev/null
+From 7d0b93499f4879ddbc75d594f4ea216ba964f78e Mon Sep 17 00:00:00 2001
+From: Aaron Lu <aaron.lu@intel.com>
+Date: Mon, 22 Dec 2014 15:18:05 +0800
+Subject: ACPI / video: Add some Samsung models to disable_native_backlight list
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+commit 7d0b93499f4879ddbc75d594f4ea216ba964f78e upstream.
+
+Several Samsung laptop models (SAMSUNG 870Z5E/880Z5E/680Z5E and
+SAMSUNG 370R4E/370R4V/370R5E/3570RE/370R5V) do not have a working
+native backlight control interface so restore their acpi_videoX
+interface.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=84221
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=84651
+For SAMSUNG 870Z5E/880Z5E/680Z5E:
+Reported-and-tested-by: Brent Saner <brent.saner@gmail.com>
+Reported-by: Vitaliy Filippov <vitalif@yourcmc.ru>
+Reported-by: Laszlo KREKACS <laszlo.krekacs.list@gmail.com>
+For SAMSUNG 370R4E/370R4V/370R5E/3570RE/370R5V:
+Reported-by: Vladimir Perepechin <vovochka13@gmail.com>
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/video.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -505,6 +505,23 @@ static struct dmi_system_id video_dmi_ta
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP ENVY 15 Notebook PC"),
+ },
+ },
++
++ {
++ .callback = video_disable_native_backlight,
++ .ident = "SAMSUNG 870Z5E/880Z5E/680Z5E",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "870Z5E/880Z5E/680Z5E"),
++ },
++ },
++ {
++ .callback = video_disable_native_backlight,
++ .ident = "SAMSUNG 370R4E/370R4V/370R5E/3570RE/370R5V",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "370R4E/370R4V/370R5E/3570RE/370R5V"),
++ },
++ },
+ {}
+ };
+
--- /dev/null
+From 0e63ea48b4d8035dd0e91a3fa6fb79458b47adfb Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Thu, 8 Jan 2015 09:54:58 +0000
+Subject: arm64/efi: add missing call to early_ioremap_reset()
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit 0e63ea48b4d8035dd0e91a3fa6fb79458b47adfb upstream.
+
+The early ioremap support introduced by patch bf4b558eba92
+("arm64: add early_ioremap support") failed to add a call to
+early_ioremap_reset() at an appropriate time. Without this call,
+invocations of early_ioremap etc. that are done too late will go
+unnoticed and may cause corruption.
+
+This is exactly what happened when the first user of this feature
+was added in patch f84d02755f5a ("arm64: add EFI runtime services").
+The early mapping of the EFI memory map is unmapped during an early
+initcall, at which time the early ioremap support is long gone.
+
+Fix by adding the missing call to early_ioremap_reset() to
+setup_arch(), and move the offending early_memunmap() to right after
+the point where the early mapping of the EFI memory map is last used.
+
+Fixes: f84d02755f5a ("arm64: add EFI runtime services")
+Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/efi.c | 2 +-
+ arch/arm64/kernel/setup.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/efi.c
++++ b/arch/arm64/kernel/efi.c
+@@ -327,6 +327,7 @@ void __init efi_idmap_init(void)
+
+ /* boot time idmap_pg_dir is incomplete, so fill in missing parts */
+ efi_setup_idmap();
++ early_memunmap(memmap.map, memmap.map_end - memmap.map);
+ }
+
+ static int __init remap_region(efi_memory_desc_t *md, void **new)
+@@ -381,7 +382,6 @@ static int __init arm64_enter_virtual_mo
+ }
+
+ mapsize = memmap.map_end - memmap.map;
+- early_memunmap(memmap.map, mapsize);
+
+ if (efi_runtime_disabled()) {
+ pr_info("EFI runtime services will be disabled.\n");
+--- a/arch/arm64/kernel/setup.c
++++ b/arch/arm64/kernel/setup.c
+@@ -394,6 +394,7 @@ void __init setup_arch(char **cmdline_p)
+ request_standard_resources();
+
+ efi_idmap_init();
++ early_ioremap_reset();
+
+ unflatten_device_tree();
+
--- /dev/null
+From f43c27188a49111b58e9611afa2f0365b0b55625 Mon Sep 17 00:00:00 2001
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Date: Fri, 19 Dec 2014 17:03:47 +0000
+Subject: arm64: kernel: fix __cpu_suspend mm switch on warm-boot
+
+From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+
+commit f43c27188a49111b58e9611afa2f0365b0b55625 upstream.
+
+On arm64 the TTBR0_EL1 register is set to either the reserved TTBR0
+page tables on boot or to the active_mm mappings belonging to user space
+processes, it must never be set to swapper_pg_dir page tables mappings.
+
+When a CPU is booted its active_mm is set to init_mm even though its
+TTBR0_EL1 points at the reserved TTBR0 page mappings. This implies
+that when __cpu_suspend is triggered the active_mm can point at
+init_mm even if the current TTBR0_EL1 register contains the reserved
+TTBR0_EL1 mappings.
+
+Therefore, the mm save and restore executed in __cpu_suspend might
+turn out to be erroneous in that, if the current->active_mm corresponds
+to init_mm, on resume from low power it ends up restoring in the
+TTBR0_EL1 the init_mm mappings that are global and can cause speculation
+of TLB entries which end up being propagated to user space.
+
+This patch fixes the issue by checking the active_mm pointer before
+restoring the TTBR0 mappings. If the current active_mm == &init_mm,
+the code sets the TTBR0_EL1 to the reserved TTBR0 mapping instead of
+switching back to the active_mm, which is the expected behaviour
+corresponding to the TTBR0_EL1 settings when __cpu_suspend was entered.
+
+Fixes: 95322526ef62 ("arm64: kernel: cpu_{suspend/resume} implementation")
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/suspend.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/kernel/suspend.c
++++ b/arch/arm64/kernel/suspend.c
+@@ -5,6 +5,7 @@
+ #include <asm/debug-monitors.h>
+ #include <asm/pgtable.h>
+ #include <asm/memory.h>
++#include <asm/mmu_context.h>
+ #include <asm/smp_plat.h>
+ #include <asm/suspend.h>
+ #include <asm/tlbflush.h>
+@@ -98,7 +99,18 @@ int __cpu_suspend(unsigned long arg, int
+ */
+ ret = __cpu_suspend_enter(arg, fn);
+ if (ret == 0) {
+- cpu_switch_mm(mm->pgd, mm);
++ /*
++ * We are resuming from reset with TTBR0_EL1 set to the
++ * idmap to enable the MMU; restore the active_mm mappings in
++ * TTBR0_EL1 unless the active_mm == &init_mm, in which case
++ * the thread entered __cpu_suspend with TTBR0_EL1 set to
++ * reserved TTBR0 page tables and should be restored as such.
++ */
++ if (mm == &init_mm)
++ cpu_set_reserved_ttbr0();
++ else
++ cpu_switch_mm(mm->pgd, mm);
++
+ flush_tlb_all();
+
+ /*
--- /dev/null
+From c3684fbb446501b48dec6677a6a9f61c215053de Mon Sep 17 00:00:00 2001
+From: Laura Abbott <lauraa@codeaurora.org>
+Date: Fri, 21 Nov 2014 21:50:40 +0000
+Subject: arm64: Move cpu_resume into the text section
+
+From: Laura Abbott <lauraa@codeaurora.org>
+
+commit c3684fbb446501b48dec6677a6a9f61c215053de upstream.
+
+The function cpu_resume currently lives in the .data section.
+There's no reason for it to be there since we can use relative
+instructions without a problem. Move a few cpu_resume data
+structures out of the assembly file so the .data annotation
+can be dropped completely and cpu_resume ends up in the read
+only text section.
+
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Mark Rutland <mark.rutland@arm.com>
+Reviewed-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Tested-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Tested-by: Kees Cook <keescook@chromium.org>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/kernel/sleep.S | 36 ++++++------------------------------
+ arch/arm64/kernel/suspend.c | 4 ++--
+ 2 files changed, 8 insertions(+), 32 deletions(-)
+
+--- a/arch/arm64/kernel/sleep.S
++++ b/arch/arm64/kernel/sleep.S
+@@ -147,14 +147,12 @@ cpu_resume_after_mmu:
+ ret
+ ENDPROC(cpu_resume_after_mmu)
+
+- .data
+ ENTRY(cpu_resume)
+ bl el2_setup // if in EL2 drop to EL1 cleanly
+ #ifdef CONFIG_SMP
+ mrs x1, mpidr_el1
+- adr x4, mpidr_hash_ptr
+- ldr x5, [x4]
+- add x8, x4, x5 // x8 = struct mpidr_hash phys address
++ adrp x8, mpidr_hash
++ add x8, x8, #:lo12:mpidr_hash // x8 = struct mpidr_hash phys address
+ /* retrieve mpidr_hash members to compute the hash */
+ ldr x2, [x8, #MPIDR_HASH_MASK]
+ ldp w3, w4, [x8, #MPIDR_HASH_SHIFTS]
+@@ -164,14 +162,15 @@ ENTRY(cpu_resume)
+ #else
+ mov x7, xzr
+ #endif
+- adr x0, sleep_save_sp
++ adrp x0, sleep_save_sp
++ add x0, x0, #:lo12:sleep_save_sp
+ ldr x0, [x0, #SLEEP_SAVE_SP_PHYS]
+ ldr x0, [x0, x7, lsl #3]
+ /* load sp from context */
+ ldr x2, [x0, #CPU_CTX_SP]
+- adr x1, sleep_idmap_phys
++ adrp x1, sleep_idmap_phys
+ /* load physical address of identity map page table in x1 */
+- ldr x1, [x1]
++ ldr x1, [x1, #:lo12:sleep_idmap_phys]
+ mov sp, x2
+ /*
+ * cpu_do_resume expects x0 to contain context physical address
+@@ -180,26 +179,3 @@ ENTRY(cpu_resume)
+ bl cpu_do_resume // PC relative jump, MMU off
+ b cpu_resume_mmu // Resume MMU, never returns
+ ENDPROC(cpu_resume)
+-
+- .align 3
+-mpidr_hash_ptr:
+- /*
+- * offset of mpidr_hash symbol from current location
+- * used to obtain run-time mpidr_hash address with MMU off
+- */
+- .quad mpidr_hash - .
+-/*
+- * physical address of identity mapped page tables
+- */
+- .type sleep_idmap_phys, #object
+-ENTRY(sleep_idmap_phys)
+- .quad 0
+-/*
+- * struct sleep_save_sp {
+- * phys_addr_t *save_ptr_stash;
+- * phys_addr_t save_ptr_stash_phys;
+- * };
+- */
+- .type sleep_save_sp, #object
+-ENTRY(sleep_save_sp)
+- .space SLEEP_SAVE_SP_SZ // struct sleep_save_sp
+--- a/arch/arm64/kernel/suspend.c
++++ b/arch/arm64/kernel/suspend.c
+@@ -126,8 +126,8 @@ int __cpu_suspend(unsigned long arg, int
+ return ret;
+ }
+
+-extern struct sleep_save_sp sleep_save_sp;
+-extern phys_addr_t sleep_idmap_phys;
++struct sleep_save_sp sleep_save_sp;
++phys_addr_t sleep_idmap_phys;
+
+ static int __init cpu_suspend_init(void)
+ {
--- /dev/null
+From 6f8960541b1eb6054a642da48daae2320fddba93 Mon Sep 17 00:00:00 2001
+From: Chris Mason <clm@fb.com>
+Date: Wed, 31 Dec 2014 12:18:29 -0500
+Subject: Btrfs: don't delay inode ref updates during log replay
+
+From: Chris Mason <clm@fb.com>
+
+commit 6f8960541b1eb6054a642da48daae2320fddba93 upstream.
+
+Commit 1d52c78afbb (Btrfs: try not to ENOSPC on log replay) added a
+check to skip delayed inode updates during log replay because it
+confuses the enospc code. But the delayed processing will end up
+ignoring delayed refs from log replay because the inode itself wasn't
+put through the delayed code.
+
+This can end up triggering a warning at commit time:
+
+WARNING: CPU: 2 PID: 778 at fs/btrfs/delayed-inode.c:1410 btrfs_assert_delayed_root_empty+0x32/0x34()
+
+Which is repeated for each commit because we never process the delayed
+inode ref update.
+
+The fix used here is to change btrfs_delayed_delete_inode_ref to return
+an error if we're currently in log replay. The caller will do the ref
+deletion immediately and everything will work properly.
+
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/delayed-inode.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -1857,6 +1857,14 @@ int btrfs_delayed_delete_inode_ref(struc
+ {
+ struct btrfs_delayed_node *delayed_node;
+
++ /*
++ * we don't do delayed inode updates during log recovery because it
++ * leads to enospc problems. This means we also can't do
++ * delayed inode refs
++ */
++ if (BTRFS_I(inode)->root->fs_info->log_root_recovering)
++ return -EAGAIN;
++
+ delayed_node = btrfs_get_or_create_delayed_node(inode);
+ if (IS_ERR(delayed_node))
+ return PTR_ERR(delayed_node);
--- /dev/null
+From 0b1e95b2fa0934c3a08db483979c70d3b287f50e Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli@googlemail.com>
+Date: Tue, 30 Dec 2014 22:50:54 +0100
+Subject: crypto: aesni - fix "by8" variant for 128 bit keys
+
+From: Mathias Krause <minipli@googlemail.com>
+
+commit 0b1e95b2fa0934c3a08db483979c70d3b287f50e upstream.
+
+The "by8" counter mode optimization is broken for 128 bit keys with
+input data longer than 128 bytes. It uses the wrong key material for
+en- and decryption.
+
+The key registers xkey0, xkey4, xkey8 and xkey12 need to be preserved
+in case we're handling more than 128 bytes of input data -- they won't
+get reloaded after the initial load. They must therefore be (a) loaded
+on the first iteration and (b) be preserved for the latter ones. The
+implementation for 128 bit keys does not comply with (a) nor (b).
+
+Fix this by bringing the implementation back to its original source
+and correctly load the key registers and preserve their values by
+*not* re-using the registers for other purposes.
+
+Kudos to James for reporting the issue and providing a test case
+showing the discrepancies.
+
+Reported-by: James Yonan <james@openvpn.net>
+Cc: Chandramouli Narayanan <mouli@linux.intel.com>
+Signed-off-by: Mathias Krause <minipli@googlemail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/crypto/aes_ctrby8_avx-x86_64.S | 46 ++++++++++++++++++++++++--------
+ 1 file changed, 35 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
++++ b/arch/x86/crypto/aes_ctrby8_avx-x86_64.S
+@@ -208,7 +208,7 @@ ddq_add_8:
+
+ .if (klen == KEY_128)
+ .if (load_keys)
+- vmovdqa 3*16(p_keys), xkeyA
++ vmovdqa 3*16(p_keys), xkey4
+ .endif
+ .else
+ vmovdqa 3*16(p_keys), xkeyA
+@@ -224,7 +224,7 @@ ddq_add_8:
+ add $(16*by), p_in
+
+ .if (klen == KEY_128)
+- vmovdqa 4*16(p_keys), xkey4
++ vmovdqa 4*16(p_keys), xkeyB
+ .else
+ .if (load_keys)
+ vmovdqa 4*16(p_keys), xkey4
+@@ -234,7 +234,12 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkeyA, var_xdata, var_xdata /* key 3 */
++ /* key 3 */
++ .if (klen == KEY_128)
++ vaesenc xkey4, var_xdata, var_xdata
++ .else
++ vaesenc xkeyA, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+@@ -243,13 +248,18 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkey4, var_xdata, var_xdata /* key 4 */
++ /* key 4 */
++ .if (klen == KEY_128)
++ vaesenc xkeyB, var_xdata, var_xdata
++ .else
++ vaesenc xkey4, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+ .if (klen == KEY_128)
+ .if (load_keys)
+- vmovdqa 6*16(p_keys), xkeyB
++ vmovdqa 6*16(p_keys), xkey8
+ .endif
+ .else
+ vmovdqa 6*16(p_keys), xkeyB
+@@ -267,12 +277,17 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkeyB, var_xdata, var_xdata /* key 6 */
++ /* key 6 */
++ .if (klen == KEY_128)
++ vaesenc xkey8, var_xdata, var_xdata
++ .else
++ vaesenc xkeyB, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+ .if (klen == KEY_128)
+- vmovdqa 8*16(p_keys), xkey8
++ vmovdqa 8*16(p_keys), xkeyB
+ .else
+ .if (load_keys)
+ vmovdqa 8*16(p_keys), xkey8
+@@ -288,7 +303,7 @@ ddq_add_8:
+
+ .if (klen == KEY_128)
+ .if (load_keys)
+- vmovdqa 9*16(p_keys), xkeyA
++ vmovdqa 9*16(p_keys), xkey12
+ .endif
+ .else
+ vmovdqa 9*16(p_keys), xkeyA
+@@ -297,7 +312,12 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkey8, var_xdata, var_xdata /* key 8 */
++ /* key 8 */
++ .if (klen == KEY_128)
++ vaesenc xkeyB, var_xdata, var_xdata
++ .else
++ vaesenc xkey8, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+@@ -306,7 +326,12 @@ ddq_add_8:
+ .set i, 0
+ .rept by
+ club XDATA, i
+- vaesenc xkeyA, var_xdata, var_xdata /* key 9 */
++ /* key 9 */
++ .if (klen == KEY_128)
++ vaesenc xkey12, var_xdata, var_xdata
++ .else
++ vaesenc xkeyA, var_xdata, var_xdata
++ .endif
+ .set i, (i +1)
+ .endr
+
+@@ -412,7 +437,6 @@ ddq_add_8:
+ /* main body of aes ctr load */
+
+ .macro do_aes_ctrmain key_len
+-
+ cmp $16, num_bytes
+ jb .Ldo_return2\key_len
+
--- /dev/null
+From 0b8c960cf6defc56b3aa1a71b5af95872b6dff2b Mon Sep 17 00:00:00 2001
+From: Vinson Lee <vlee@twitter.com>
+Date: Mon, 29 Dec 2014 16:20:39 -0800
+Subject: crypto: sha-mb - Add avx2_supported check.
+
+From: Vinson Lee <vlee@twitter.com>
+
+commit 0b8c960cf6defc56b3aa1a71b5af95872b6dff2b upstream.
+
+This patch fixes this allyesconfig target build error with older
+binutils.
+
+ LD arch/x86/crypto/built-in.o
+ld: arch/x86/crypto/sha-mb/built-in.o: No such file: No such file or directory
+
+Signed-off-by: Vinson Lee <vlee@twitter.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/crypto/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/crypto/Makefile
++++ b/arch/x86/crypto/Makefile
+@@ -26,7 +26,6 @@ obj-$(CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL
+
+ obj-$(CONFIG_CRYPTO_CRC32C_INTEL) += crc32c-intel.o
+ obj-$(CONFIG_CRYPTO_SHA1_SSSE3) += sha1-ssse3.o
+-obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
+ obj-$(CONFIG_CRYPTO_CRC32_PCLMUL) += crc32-pclmul.o
+ obj-$(CONFIG_CRYPTO_SHA256_SSSE3) += sha256-ssse3.o
+ obj-$(CONFIG_CRYPTO_SHA512_SSSE3) += sha512-ssse3.o
+@@ -46,6 +45,7 @@ endif
+ ifeq ($(avx2_supported),yes)
+ obj-$(CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64) += camellia-aesni-avx2.o
+ obj-$(CONFIG_CRYPTO_SERPENT_AVX2_X86_64) += serpent-avx2.o
++ obj-$(CONFIG_CRYPTO_SHA1_MB) += sha-mb/
+ endif
+
+ aes-i586-y := aes-i586-asm_32.o aes_glue.o
--- /dev/null
+From d27eb7931c98a1ebfc9b2fcc48939846bcbfc804 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 18 Dec 2014 09:55:14 -0800
+Subject: Input: alps - v7: fix finger counting for > 2 fingers on clickpads
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit d27eb7931c98a1ebfc9b2fcc48939846bcbfc804 upstream.
+
+Protocol v7 uses the middle / right button bits on clickpads to communicate
+"location" information of a 3th touch (and possible 4th) touch on
+clickpads.
+
+Specifically when 3 touches are down, if one of the 3 touches is in the
+left / right button area, this will get reported in the middle / right
+button bits and the touchpad will still send a TWO type packet rather then
+a MULTI type packet, so when this happens we must add the finger reported
+in the button area to the finger count.
+
+Likewise we must also add fingers reported this way to the finger count
+when we get MULTI packets.
+
+BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=86338
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/alps.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -933,6 +933,7 @@ static int alps_decode_packet_v7(struct
+ unsigned char *p,
+ struct psmouse *psmouse)
+ {
++ struct alps_data *priv = psmouse->private;
+ unsigned char pkt_id;
+
+ pkt_id = alps_get_packet_id_v7(p);
+@@ -963,15 +964,22 @@ static int alps_decode_packet_v7(struct
+
+ alps_get_finger_coordinate_v7(f->mt, p, pkt_id);
+
+- f->left = (p[0] & 0x80) >> 7;
+- f->right = (p[0] & 0x20) >> 5;
+- f->middle = (p[0] & 0x10) >> 4;
+-
+ if (pkt_id == V7_PACKET_ID_TWO)
+ f->fingers = alps_get_mt_count(f->mt);
+ else /* pkt_id == V7_PACKET_ID_MULTI */
+ f->fingers = 3 + (p[5] & 0x03);
+
++ f->left = (p[0] & 0x80) >> 7;
++ if (priv->flags & ALPS_BUTTONPAD) {
++ if (p[0] & 0x20)
++ f->fingers++;
++ if (p[0] & 0x10)
++ f->fingers++;
++ } else {
++ f->right = (p[0] & 0x20) >> 5;
++ f->middle = (p[0] & 0x10) >> 4;
++ }
++
+ /* Sometimes a single touch is reported in mt[1] rather then mt[0] */
+ if (f->fingers == 1 && f->mt[0].x == 0 && f->mt[0].y == 0) {
+ f->mt[0].x = f->mt[1].x;
--- /dev/null
+From 8b23811535d2e1dd6abbe4ce6ea1edfd50ce72de Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 18 Dec 2014 09:52:59 -0800
+Subject: Input: alps - v7: ignore new packets
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 8b23811535d2e1dd6abbe4ce6ea1edfd50ce72de upstream.
+
+NEW packets are send to indicate a discontinuity in the finger coordinate
+reporting. Specifically a finger may have moved from slot 0 to 1 or vice
+versa. INPUT_MT_TRACK takes care of this for us.
+
+NEW packets have 3 problems:
+1) They do not contain middle / right button info (on non clickpads)
+ this can be worked around by preserving the old button state
+2) They do not contain an accurate fingercount, and they are
+ typically send when the number of fingers changes. We cannot use
+ the old finger count as that may mismatch with the amount of
+ touch coordinates we've available in the NEW packet
+3) Their x data for the second touch is inaccurate leading to
+ a possible jump of the x coordinate by 16 units when the first
+ non NEW packet comes in
+
+Since problems 2 & 3 cannot be worked around, just ignore them.
+
+BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=86338
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/alps.c | 30 ++++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -938,18 +938,36 @@ static int alps_decode_packet_v7(struct
+ return 0;
+ if (pkt_id == V7_PACKET_ID_UNKNOWN)
+ return -1;
++ /*
++ * NEW packets are send to indicate a discontinuity in the finger
++ * coordinate reporting. Specifically a finger may have moved from
++ * slot 0 to 1 or vice versa. INPUT_MT_TRACK takes care of this for
++ * us.
++ *
++ * NEW packets have 3 problems:
++ * 1) They do not contain middle / right button info (on non clickpads)
++ * this can be worked around by preserving the old button state
++ * 2) They do not contain an accurate fingercount, and they are
++ * typically send when the number of fingers changes. We cannot use
++ * the old finger count as that may mismatch with the amount of
++ * touch coordinates we've available in the NEW packet
++ * 3) Their x data for the second touch is inaccurate leading to
++ * a possible jump of the x coordinate by 16 units when the first
++ * non NEW packet comes in
++ * Since problems 2 & 3 cannot be worked around, just ignore them.
++ */
++ if (pkt_id == V7_PACKET_ID_NEW)
++ return 1;
+
+ alps_get_finger_coordinate_v7(f->mt, p, pkt_id);
+
+- if (pkt_id == V7_PACKET_ID_TWO || pkt_id == V7_PACKET_ID_MULTI) {
+- f->left = (p[0] & 0x80) >> 7;
+- f->right = (p[0] & 0x20) >> 5;
+- f->middle = (p[0] & 0x10) >> 4;
+- }
++ f->left = (p[0] & 0x80) >> 7;
++ f->right = (p[0] & 0x20) >> 5;
++ f->middle = (p[0] & 0x10) >> 4;
+
+ if (pkt_id == V7_PACKET_ID_TWO)
+ f->fingers = alps_get_mt_count(f->mt);
+- else if (pkt_id == V7_PACKET_ID_MULTI)
++ else /* pkt_id == V7_PACKET_ID_MULTI */
+ f->fingers = 3 + (p[5] & 0x03);
+
+ return 0;
--- /dev/null
+From 7091c443dda8c6c6d8e70e33452252f9ad3e7814 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Thu, 18 Dec 2014 09:53:34 -0800
+Subject: Input: alps - v7: sometimes a single touch is reported in mt[1]
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 7091c443dda8c6c6d8e70e33452252f9ad3e7814 upstream.
+
+The v7 proto differentiates between a primary touch (with high precision)
+and a secondary touch (with lower precision). Normally when 2 fingers are
+down and one is lifted the still present touch becomes the primary touch,
+but some traces have shown that this does not happen always.
+
+This commit deals with this by making alps_get_mt_count() not stop at the
+first empty mt slot, and if a touch is present in mt[1] and not mt[0]
+moving the data to mt[0] (for input_mt_assign_slots).
+
+BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=86338
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/mouse/alps.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -919,12 +919,14 @@ static void alps_get_finger_coordinate_v
+
+ static int alps_get_mt_count(struct input_mt_pos *mt)
+ {
+- int i;
++ int i, fingers = 0;
+
+- for (i = 0; i < MAX_TOUCHES && mt[i].x != 0 && mt[i].y != 0; i++)
+- /* empty */;
++ for (i = 0; i < MAX_TOUCHES; i++) {
++ if (mt[i].x != 0 || mt[i].y != 0)
++ fingers++;
++ }
+
+- return i;
++ return fingers;
+ }
+
+ static int alps_decode_packet_v7(struct alps_fields *f,
+@@ -970,6 +972,14 @@ static int alps_decode_packet_v7(struct
+ else /* pkt_id == V7_PACKET_ID_MULTI */
+ f->fingers = 3 + (p[5] & 0x03);
+
++ /* Sometimes a single touch is reported in mt[1] rather then mt[0] */
++ if (f->fingers == 1 && f->mt[0].x == 0 && f->mt[0].y == 0) {
++ f->mt[0].x = f->mt[1].x;
++ f->mt[0].y = f->mt[1].y;
++ f->mt[1].x = 0;
++ f->mt[1].y = 0;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From 9fc81d87420d0d3fd62d5e5529972c0ad9eab9cc Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Wed, 10 Dec 2014 21:23:51 +0100
+Subject: perf: Fix events installation during moving group
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+commit 9fc81d87420d0d3fd62d5e5529972c0ad9eab9cc upstream.
+
+We allow PMU driver to change the cpu on which the event
+should be installed to. This happened in patch:
+
+ e2d37cd213dc ("perf: Allow the PMU driver to choose the CPU on which to install events")
+
+This patch also forces all the group members to follow
+the currently opened events cpu if the group happened
+to be moved.
+
+This and the change of event->cpu in perf_install_in_context()
+function introduced in:
+
+ 0cda4c023132 ("perf: Introduce perf_pmu_migrate_context()")
+
+forces group members to change their event->cpu,
+if the currently-opened-event's PMU changed the cpu
+and there is a group move.
+
+Above behaviour causes problem for breakpoint events,
+which uses event->cpu to touch cpu specific data for
+breakpoints accounting. By changing event->cpu, some
+breakpoints slots were wrongly accounted for given
+cpu.
+
+Vinces's perf fuzzer hit this issue and caused following
+WARN on my setup:
+
+ WARNING: CPU: 0 PID: 20214 at arch/x86/kernel/hw_breakpoint.c:119 arch_install_hw_breakpoint+0x142/0x150()
+ Can't find any breakpoint slot
+ [...]
+
+This patch changes the group moving code to keep the event's
+original cpu.
+
+Reported-by: Vince Weaver <vince@deater.net>
+Signed-off-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Vince Weaver <vince@deater.net>
+Cc: Yan, Zheng <zheng.z.yan@intel.com>
+Link: http://lkml.kernel.org/r/1418243031-20367-3-git-send-email-jolsa@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/events/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -7435,11 +7435,11 @@ SYSCALL_DEFINE5(perf_event_open,
+
+ if (move_group) {
+ synchronize_rcu();
+- perf_install_in_context(ctx, group_leader, event->cpu);
++ perf_install_in_context(ctx, group_leader, group_leader->cpu);
+ get_ctx(ctx);
+ list_for_each_entry(sibling, &group_leader->sibling_list,
+ group_entry) {
+- perf_install_in_context(ctx, sibling, event->cpu);
++ perf_install_in_context(ctx, sibling, sibling->cpu);
+ get_ctx(ctx);
+ }
+ }
--- /dev/null
+From f61ff6c06dc8f32c7036013ad802c899ec590607 Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Wed, 26 Nov 2014 16:39:31 +0100
+Subject: perf session: Do not fail on processing out of order event
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+commit f61ff6c06dc8f32c7036013ad802c899ec590607 upstream.
+
+Linus reported perf report command being interrupted due to processing
+of 'out of order' event, with following error:
+
+ Timestamp below last timeslice flush
+ 0x5733a8 [0x28]: failed to process type: 3
+
+I could reproduce the issue and in my case it was caused by one CPU
+(mmap) being behind during record and userspace mmap reader seeing the
+data after other CPUs data were already stored.
+
+This is expected under some circumstances because we need to limit the
+number of events that we queue for reordering when we receive a
+PERF_RECORD_FINISHED_ROUND or when we force flush due to memory
+pressure.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matt Fleming <matt.fleming@intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
+Cc: Stephane Eranian <eranian@google.com>
+Link: http://lkml.kernel.org/r/1417016371-30249-1-git-send-email-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Zhiqiang Zhang <zhangzhiqiang.zhang@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/event.h | 1 +
+ tools/perf/util/session.c | 11 +++++------
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/tools/perf/util/event.h
++++ b/tools/perf/util/event.h
+@@ -214,6 +214,7 @@ struct events_stats {
+ u32 nr_invalid_chains;
+ u32 nr_unknown_id;
+ u32 nr_unprocessable_samples;
++ u32 nr_unordered_events;
+ };
+
+ struct attr_event {
+--- a/tools/perf/util/session.c
++++ b/tools/perf/util/session.c
+@@ -521,15 +521,11 @@ int perf_session_queue_event(struct perf
+ return -ETIME;
+
+ if (timestamp < oe->last_flush) {
+- WARN_ONCE(1, "Timestamp below last timeslice flush\n");
+-
+- pr_oe_time(timestamp, "out of order event");
++ pr_oe_time(timestamp, "out of order event\n");
+ pr_oe_time(oe->last_flush, "last flush, last_flush_type %d\n",
+ oe->last_flush_type);
+
+- /* We could get out of order messages after forced flush. */
+- if (oe->last_flush_type != OE_FLUSH__HALF)
+- return -EINVAL;
++ s->stats.nr_unordered_events++;
+ }
+
+ new = ordered_events__new(oe, timestamp, event);
+@@ -1057,6 +1053,9 @@ static void perf_session__warn_about_err
+ "Do you have a KVM guest running and not using 'perf kvm'?\n",
+ session->stats.nr_unprocessable_samples);
+ }
++
++ if (session->stats.nr_unordered_events != 0)
++ ui__warning("%u out of order events recorded.\n", session->stats.nr_unordered_events);
+ }
+
+ volatile int session_done;
--- /dev/null
+From af91568e762d04931dcbdd6bef4655433d8b9418 Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Wed, 10 Dec 2014 21:23:50 +0100
+Subject: perf/x86/intel/uncore: Make sure only uncore events are collected
+
+From: Jiri Olsa <jolsa@kernel.org>
+
+commit af91568e762d04931dcbdd6bef4655433d8b9418 upstream.
+
+The uncore_collect_events functions assumes that event group
+might contain only uncore events which is wrong, because it
+might contain any type of events.
+
+This bug leads to uncore framework touching 'not' uncore events,
+which could end up all sorts of bugs.
+
+One was triggered by Vince's perf fuzzer, when the uncore code
+touched breakpoint event private event space as if it was uncore
+event and caused BUG:
+
+ BUG: unable to handle kernel paging request at ffffffff82822068
+ IP: [<ffffffff81020338>] uncore_assign_events+0x188/0x250
+ ...
+
+The code in uncore_assign_events() function was looking for
+event->hw.idx data while the event was initialized as a
+breakpoint with different members in event->hw union.
+
+This patch forces uncore_collect_events() to collect only uncore
+events.
+
+Reported-by: Vince Weaver <vince@deater.net>
+Signed-off-by: Jiri Olsa <jolsa@redhat.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Yan, Zheng <zheng.z.yan@intel.com>
+Link: http://lkml.kernel.org/r/1418243031-20367-2-git-send-email-jolsa@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_intel_uncore.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+@@ -276,6 +276,17 @@ static struct intel_uncore_box *uncore_a
+ return box;
+ }
+
++/*
++ * Using uncore_pmu_event_init pmu event_init callback
++ * as a detection point for uncore events.
++ */
++static int uncore_pmu_event_init(struct perf_event *event);
++
++static bool is_uncore_event(struct perf_event *event)
++{
++ return event->pmu->event_init == uncore_pmu_event_init;
++}
++
+ static int
+ uncore_collect_events(struct intel_uncore_box *box, struct perf_event *leader, bool dogrp)
+ {
+@@ -290,13 +301,18 @@ uncore_collect_events(struct intel_uncor
+ return -EINVAL;
+
+ n = box->n_events;
+- box->event_list[n] = leader;
+- n++;
++
++ if (is_uncore_event(leader)) {
++ box->event_list[n] = leader;
++ n++;
++ }
++
+ if (!dogrp)
+ return n;
+
+ list_for_each_entry(event, &leader->sibling_list, group_entry) {
+- if (event->state <= PERF_EVENT_STATE_OFF)
++ if (!is_uncore_event(event) ||
++ event->state <= PERF_EVENT_STATE_OFF)
+ continue;
+
+ if (n >= max_count)
--- /dev/null
+From 5306c31c5733cb4a79cc002e0c3ad256fd439614 Mon Sep 17 00:00:00 2001
+From: Andi Kleen <ak@linux.intel.com>
+Date: Tue, 6 Jan 2015 14:34:35 -0800
+Subject: perf/x86/uncore/hsw-ep: Handle systems with only two SBOXes
+
+From: Andi Kleen <ak@linux.intel.com>
+
+commit 5306c31c5733cb4a79cc002e0c3ad256fd439614 upstream.
+
+There was another report of a boot failure with a #GP fault in the
+uncore SBOX initialization. The earlier work around was not enough
+for this system.
+
+The boot was failing while trying to initialize the third SBOX.
+
+This patch detects parts with only two SBOXes and limits the number
+of SBOX units to two there.
+
+Stable material, as it affects boot problems on 3.18.
+
+Tested-by: Andreas Oehler <andreas@oehler-net.de>
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Yan, Zheng <zheng.z.yan@intel.com>
+Link: http://lkml.kernel.org/r/1420583675-9163-1-git-send-email-andi@firstfloor.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_intel_uncore.h | 2 +-
+ arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c | 17 +++++++++++++++++
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.h
++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.h
+@@ -17,7 +17,7 @@
+ #define UNCORE_PCI_DEV_TYPE(data) ((data >> 8) & 0xff)
+ #define UNCORE_PCI_DEV_IDX(data) (data & 0xff)
+ #define UNCORE_EXTRA_PCI_DEV 0xff
+-#define UNCORE_EXTRA_PCI_DEV_MAX 2
++#define UNCORE_EXTRA_PCI_DEV_MAX 3
+
+ /* support up to 8 sockets */
+ #define UNCORE_SOCKET_MAX 8
+--- a/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_uncore_snbep.c
+@@ -887,6 +887,7 @@ void snbep_uncore_cpu_init(void)
+ enum {
+ SNBEP_PCI_QPI_PORT0_FILTER,
+ SNBEP_PCI_QPI_PORT1_FILTER,
++ HSWEP_PCI_PCU_3,
+ };
+
+ static int snbep_qpi_hw_config(struct intel_uncore_box *box, struct perf_event *event)
+@@ -2022,6 +2023,17 @@ void hswep_uncore_cpu_init(void)
+ {
+ if (hswep_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores)
+ hswep_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores;
++
++ /* Detect 6-8 core systems with only two SBOXes */
++ if (uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3]) {
++ u32 capid4;
++
++ pci_read_config_dword(uncore_extra_pci_dev[0][HSWEP_PCI_PCU_3],
++ 0x94, &capid4);
++ if (((capid4 >> 6) & 0x3) == 0)
++ hswep_uncore_sbox.num_boxes = 2;
++ }
++
+ uncore_msr_uncores = hswep_msr_uncores;
+ }
+
+@@ -2279,6 +2291,11 @@ static DEFINE_PCI_DEVICE_TABLE(hswep_unc
+ .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
+ SNBEP_PCI_QPI_PORT1_FILTER),
+ },
++ { /* PCU.3 (for Capability registers) */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x2fc0),
++ .driver_data = UNCORE_PCI_DEV_DATA(UNCORE_EXTRA_PCI_DEV,
++ HSWEP_PCI_PCU_3),
++ },
+ { /* end: all zeroes */ }
+ };
+
--- /dev/null
+From 7f4054836d811c650c51f9c93088f8ebd61b0020 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Wed, 31 Dec 2014 12:59:34 -0800
+Subject: Revert "Input: atmel_mxt_ts - use deep sleep mode when stopped"
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 7f4054836d811c650c51f9c93088f8ebd61b0020 upstream.
+
+This reverts commit 9d469d033d135d80742a4e39e6bbb4519dd5eee1.
+
+It breaks the Chromebook Pixel touchpad (and touchscreen).
+
+Reported-by: Dirk Hohndel <dirk@hohndel.org>
+Bisected-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Nick Dyer <nick.dyer@itdev.co.uk>
+Cc: Benson Leung <bleung@chromium.org>
+Cc: Yufeng Shen <miletus@chromium.org>
+Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/touchscreen/atmel_mxt_ts.c | 99 ++++++++-----------------------
+ 1 file changed, 26 insertions(+), 73 deletions(-)
+
+--- a/drivers/input/touchscreen/atmel_mxt_ts.c
++++ b/drivers/input/touchscreen/atmel_mxt_ts.c
+@@ -99,13 +99,9 @@
+ #define MXT_T6_STATUS_COMSERR (1 << 2)
+
+ /* MXT_GEN_POWER_T7 field */
+-struct t7_config {
+- u8 idle;
+- u8 active;
+-} __packed;
+-
+-#define MXT_POWER_CFG_RUN 0
+-#define MXT_POWER_CFG_DEEPSLEEP 1
++#define MXT_POWER_IDLEACQINT 0
++#define MXT_POWER_ACTVACQINT 1
++#define MXT_POWER_ACTV2IDLETO 2
+
+ /* MXT_GEN_ACQUIRE_T8 field */
+ #define MXT_ACQUIRE_CHRGTIME 0
+@@ -117,6 +113,7 @@ struct t7_config {
+ #define MXT_ACQUIRE_ATCHCALSTHR 7
+
+ /* MXT_TOUCH_MULTI_T9 field */
++#define MXT_TOUCH_CTRL 0
+ #define MXT_T9_ORIENT 9
+ #define MXT_T9_RANGE 18
+
+@@ -256,7 +253,6 @@ struct mxt_data {
+ bool update_input;
+ u8 last_message_count;
+ u8 num_touchids;
+- struct t7_config t7_cfg;
+
+ /* Cached parameters from object table */
+ u16 T5_address;
+@@ -672,6 +668,20 @@ static void mxt_proc_t6_messages(struct
+ data->t6_status = status;
+ }
+
++static int mxt_write_object(struct mxt_data *data,
++ u8 type, u8 offset, u8 val)
++{
++ struct mxt_object *object;
++ u16 reg;
++
++ object = mxt_get_object(data, type);
++ if (!object || offset >= mxt_obj_size(object))
++ return -EINVAL;
++
++ reg = object->start_address;
++ return mxt_write_reg(data->client, reg + offset, val);
++}
++
+ static void mxt_input_button(struct mxt_data *data, u8 *message)
+ {
+ struct input_dev *input = data->input_dev;
+@@ -1742,60 +1752,6 @@ err_free_object_table:
+ return error;
+ }
+
+-static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep)
+-{
+- struct device *dev = &data->client->dev;
+- int error;
+- struct t7_config *new_config;
+- struct t7_config deepsleep = { .active = 0, .idle = 0 };
+-
+- if (sleep == MXT_POWER_CFG_DEEPSLEEP)
+- new_config = &deepsleep;
+- else
+- new_config = &data->t7_cfg;
+-
+- error = __mxt_write_reg(data->client, data->T7_address,
+- sizeof(data->t7_cfg), new_config);
+- if (error)
+- return error;
+-
+- dev_dbg(dev, "Set T7 ACTV:%d IDLE:%d\n",
+- new_config->active, new_config->idle);
+-
+- return 0;
+-}
+-
+-static int mxt_init_t7_power_cfg(struct mxt_data *data)
+-{
+- struct device *dev = &data->client->dev;
+- int error;
+- bool retry = false;
+-
+-recheck:
+- error = __mxt_read_reg(data->client, data->T7_address,
+- sizeof(data->t7_cfg), &data->t7_cfg);
+- if (error)
+- return error;
+-
+- if (data->t7_cfg.active == 0 || data->t7_cfg.idle == 0) {
+- if (!retry) {
+- dev_dbg(dev, "T7 cfg zero, resetting\n");
+- mxt_soft_reset(data);
+- retry = true;
+- goto recheck;
+- } else {
+- dev_dbg(dev, "T7 cfg zero after reset, overriding\n");
+- data->t7_cfg.active = 20;
+- data->t7_cfg.idle = 100;
+- return mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
+- }
+- }
+-
+- dev_dbg(dev, "Initialized power cfg: ACTV %d, IDLE %d\n",
+- data->t7_cfg.active, data->t7_cfg.idle);
+- return 0;
+-}
+-
+ static int mxt_configure_objects(struct mxt_data *data,
+ const struct firmware *cfg)
+ {
+@@ -1809,12 +1765,6 @@ static int mxt_configure_objects(struct
+ dev_warn(dev, "Error %d updating config\n", error);
+ }
+
+- error = mxt_init_t7_power_cfg(data);
+- if (error) {
+- dev_err(dev, "Failed to initialize power cfg\n");
+- return error;
+- }
+-
+ error = mxt_initialize_t9_input_device(data);
+ if (error)
+ return error;
+@@ -2093,15 +2043,16 @@ static const struct attribute_group mxt_
+
+ static void mxt_start(struct mxt_data *data)
+ {
+- mxt_set_t7_power_cfg(data, MXT_POWER_CFG_RUN);
+-
+- /* Recalibrate since chip has been in deep sleep */
+- mxt_t6_command(data, MXT_COMMAND_CALIBRATE, 1, false);
++ /* Touch enable */
++ mxt_write_object(data,
++ MXT_TOUCH_MULTI_T9, MXT_TOUCH_CTRL, 0x83);
+ }
+
+ static void mxt_stop(struct mxt_data *data)
+ {
+- mxt_set_t7_power_cfg(data, MXT_POWER_CFG_DEEPSLEEP);
++ /* Touch disable */
++ mxt_write_object(data,
++ MXT_TOUCH_MULTI_T9, MXT_TOUCH_CTRL, 0);
+ }
+
+ static int mxt_input_open(struct input_dev *dev)
+@@ -2267,6 +2218,8 @@ static int mxt_resume(struct device *dev
+ struct mxt_data *data = i2c_get_clientdata(client);
+ struct input_dev *input_dev = data->input_dev;
+
++ mxt_soft_reset(data);
++
+ mutex_lock(&input_dev->mutex);
+
+ if (input_dev->users)
--- /dev/null
+From 1e359a5de861a57aa04d92bb620f52a5c1d7f8b1 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 5 Jan 2015 10:28:49 +0100
+Subject: Revert "mac80211: Fix accounting of the tailroom-needed counter"
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit 1e359a5de861a57aa04d92bb620f52a5c1d7f8b1 upstream.
+
+This reverts commit ca34e3b5c808385b175650605faa29e71e91991b.
+
+It turns out that the p54 and cw2100 drivers assume that there's
+tailroom even when they don't say they really need it. However,
+there's currently no way for them to explicitly say they do need
+it, so for now revert this.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=90331.
+
+Fixes: ca34e3b5c808 ("mac80211: Fix accounting of the tailroom-needed counter")
+Reported-by: Christopher Chavez <chrischavez@gmx.us>
+Bisected-by: Larry Finger <Larry.Finger@lwfinger.net>
+Debugged-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/mac80211.h | 7 ++-----
+ net/mac80211/key.c | 12 +++++++++---
+ 2 files changed, 11 insertions(+), 8 deletions(-)
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1227,8 +1227,7 @@ struct ieee80211_vif *wdev_to_ieee80211_
+ *
+ * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
+ * driver to indicate that it requires IV generation for this
+- * particular key. Setting this flag does not necessarily mean that SKBs
+- * will have sufficient tailroom for ICV or MIC.
++ * particular key.
+ * @IEEE80211_KEY_FLAG_GENERATE_MMIC: This flag should be set by
+ * the driver for a TKIP key if it requires Michael MIC
+ * generation in software.
+@@ -1240,9 +1239,7 @@ struct ieee80211_vif *wdev_to_ieee80211_
+ * @IEEE80211_KEY_FLAG_PUT_IV_SPACE: This flag should be set by the driver
+ * if space should be prepared for the IV, but the IV
+ * itself should not be generated. Do not set together with
+- * @IEEE80211_KEY_FLAG_GENERATE_IV on the same key. Setting this flag does
+- * not necessarily mean that SKBs will have sufficient tailroom for ICV or
+- * MIC.
++ * @IEEE80211_KEY_FLAG_GENERATE_IV on the same key.
+ * @IEEE80211_KEY_FLAG_RX_MGMT: This key will be used to decrypt received
+ * management frames. The flag can help drivers that have a hardware
+ * crypto implementation that doesn't deal with management frames
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -131,7 +131,9 @@ static int ieee80211_key_enable_hw_accel
+ if (!ret) {
+ key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+- if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
++ if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+ sdata->crypto_tx_tailroom_needed_cnt--;
+
+ WARN_ON((key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE) &&
+@@ -179,7 +181,9 @@ static void ieee80211_key_disable_hw_acc
+ sta = key->sta;
+ sdata = key->sdata;
+
+- if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
++ if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+ increment_tailroom_need_count(sdata);
+
+ ret = drv_set_key(key->local, DISABLE_KEY, sdata,
+@@ -875,7 +879,9 @@ void ieee80211_remove_key(struct ieee802
+ if (key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
+ key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
+
+- if (!(key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC))
++ if (!((key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_MMIC) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_GENERATE_IV) ||
++ (key->conf.flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE)))
+ increment_tailroom_need_count(key->sdata);
+ }
+
--- /dev/null
+From 49a068f82a1d30eb585d7804b05948376be6cf9a Mon Sep 17 00:00:00 2001
+From: "J. Bruce Fields" <bfields@redhat.com>
+Date: Mon, 22 Dec 2014 16:14:51 -0500
+Subject: rpc: fix xdr_truncate_encode to handle buffer ending on page boundary
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: "J. Bruce Fields" <bfields@redhat.com>
+
+commit 49a068f82a1d30eb585d7804b05948376be6cf9a upstream.
+
+A struct xdr_stream at a page boundary might point to the end of one
+page or the beginning of the next, but xdr_truncate_encode isn't
+prepared to handle the former.
+
+This can cause corruption of NFSv4 READDIR replies in the case that a
+readdir entry that would have exceeded the client's dircount/maxcount
+limit would have ended exactly on a 4k page boundary. You're more
+likely to hit this case on large directories.
+
+Other xdr_truncate_encode callers are probably also affected.
+
+Reported-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
+Tested-by: Holger Hoffstätte <holger.hoffstaette@googlemail.com>
+Fixes: 3e19ce762b53 "rpc: xdr_truncate_encode"
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xdr.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -606,7 +606,7 @@ void xdr_truncate_encode(struct xdr_stre
+ struct kvec *head = buf->head;
+ struct kvec *tail = buf->tail;
+ int fraglen;
+- int new, old;
++ int new;
+
+ if (len > buf->len) {
+ WARN_ON_ONCE(1);
+@@ -628,8 +628,8 @@ void xdr_truncate_encode(struct xdr_stre
+ buf->len -= fraglen;
+
+ new = buf->page_base + buf->page_len;
+- old = new + fraglen;
+- xdr->page_ptr -= (old >> PAGE_SHIFT) - (new >> PAGE_SHIFT);
++
++ xdr->page_ptr = buf->pages + (new >> PAGE_SHIFT);
+
+ if (buf->page_len && buf->len == len) {
+ xdr->p = page_address(*xdr->page_ptr);
arm-dts-enable-pwm-node-by-default-for-s3c64xx.patch
arm-omap4-pm-only-do-static-dependency-configuration-in-omap4_init_static_deps.patch
revert-arm-7830-1-delay-don-t-bother-reporting-bogomips-in-proc-cpuinfo.patch
+rpc-fix-xdr_truncate_encode-to-handle-buffer-ending-on-page-boundary.patch
+acpi-video-add-some-samsung-models-to-disable_native_backlight-list.patch
+acpi-pm-fix-pm-initialization-for-devices-that-are-not-present.patch
+revert-input-atmel_mxt_ts-use-deep-sleep-mode-when-stopped.patch
+input-alps-v7-ignore-new-packets.patch
+input-alps-v7-sometimes-a-single-touch-is-reported-in-mt.patch
+input-alps-v7-fix-finger-counting-for-2-fingers-on-clickpads.patch
+arm64-move-cpu_resume-into-the-text-section.patch
+arm64-kernel-fix-__cpu_suspend-mm-switch-on-warm-boot.patch
+arm64-efi-add-missing-call-to-early_ioremap_reset.patch
+crypto-sha-mb-add-avx2_supported-check.patch
+crypto-aesni-fix-by8-variant-for-128-bit-keys.patch
+btrfs-don-t-delay-inode-ref-updates-during-log-replay.patch
+revert-mac80211-fix-accounting-of-the-tailroom-needed-counter.patch
+perf-x86-intel-uncore-make-sure-only-uncore-events-are-collected.patch
+perf-fix-events-installation-during-moving-group.patch
+perf-x86-uncore-hsw-ep-handle-systems-with-only-two-sboxes.patch
+perf-session-do-not-fail-on-processing-out-of-order-event.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
