--- /dev/null
+From a823a17981a73faa115bc0f7eda0190763075e2c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 22 Nov 2016 18:11:08 +0100
+Subject: ASoC: cht_bsw_rt5645: Fix leftover kmalloc
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit a823a17981a73faa115bc0f7eda0190763075e2c upstream.
+
+cht_bsw_rt5645 driver allocates the own codec_id string but doesn't
+release it. For simplicity, put the string in cht_mc_private; then
+the string is allocated in a shot and released altogether.
+
+Fixes: c8560b7c917f ("ASoC: cht_bsw_rt5645: Fix writing to string literal")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/intel/boards/cht_bsw_rt5645.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/intel/boards/cht_bsw_rt5645.c
++++ b/sound/soc/intel/boards/cht_bsw_rt5645.c
+@@ -44,6 +44,7 @@ struct cht_acpi_card {
+ struct cht_mc_private {
+ struct snd_soc_jack jack;
+ struct cht_acpi_card *acpi_card;
++ char codec_name[16];
+ };
+
+ static inline struct snd_soc_dai *cht_get_codec_dai(struct snd_soc_card *card)
+@@ -354,7 +355,6 @@ static int snd_cht_mc_probe(struct platf
+ int i;
+ struct cht_mc_private *drv;
+ struct snd_soc_card *card = snd_soc_cards[0].soc_card;
+- char codec_name[16];
+ struct sst_acpi_mach *mach;
+ const char *i2c_name = NULL;
+ int dai_index = 0;
+@@ -374,12 +374,12 @@ static int snd_cht_mc_probe(struct platf
+ }
+ card->dev = &pdev->dev;
+ mach = card->dev->platform_data;
+- sprintf(codec_name, "i2c-%s:00", drv->acpi_card->codec_id);
++ sprintf(drv->codec_name, "i2c-%s:00", drv->acpi_card->codec_id);
+
+ /* set correct codec name */
+ for (i = 0; i < ARRAY_SIZE(cht_dailink); i++)
+ if (!strcmp(card->dai_link[i].codec_name, "i2c-10EC5645:00")) {
+- card->dai_link[i].codec_name = kstrdup(codec_name, GFP_KERNEL);
++ card->dai_link[i].codec_name = drv->codec_name;
+ dai_index = i;
+ }
+
--- /dev/null
+From c8eabf821cac120afb78ca251b07cbf520406a7e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 13 Oct 2016 11:55:48 +0300
+Subject: ASoC: Intel: Skylake: Fix a shift wrapping bug
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit c8eabf821cac120afb78ca251b07cbf520406a7e upstream.
+
+"*val" is a u64. It definitely looks like we intend to use the high 32
+bits as well.
+
+Fixes: 700a9a63f9c1 ("ASoC: Intel: Skylake: Add module instance id generation APIs")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Vinod Koul <vinod.koul@intel.com>
+Tested-by: Kranthi G <gudishax.kranthikumar@intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/intel/skylake/skl-sst-utils.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/intel/skylake/skl-sst-utils.c
++++ b/sound/soc/intel/skylake/skl-sst-utils.c
+@@ -179,7 +179,7 @@ static inline int skl_getid_32(struct uu
+ index = ffz(mask_val);
+ pvt_id = index + word1_mask + word2_mask;
+ if (pvt_id <= (max_inst - 1)) {
+- *val |= 1 << (index + word1_mask);
++ *val |= 1ULL << (index + word1_mask);
+ return pvt_id;
+ }
+ }
--- /dev/null
+From 3b89e4b77ef9c2f985964fab17032db98f074ed0 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 8 Nov 2016 14:38:52 +0100
+Subject: ASoC: lpass-platform: initialize dma channel number
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 3b89e4b77ef9c2f985964fab17032db98f074ed0 upstream.
+
+A bugfix accidentally removed the implicit initialization of the
+dma channel number, causing undefined behavior when
+v->alloc_dma_channel is NULL:
+
+sound/soc/qcom/lpass-platform.c: In function ‘lpass_platform_pcmops_open’:
+sound/soc/qcom/lpass-platform.c:83:29: error: ‘dma_ch’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
+
+This adds back an explicit initialization to zero, restoring the
+previous behavior for that case.
+
+Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Kenneth Westfield <kwestfie@codeaurora.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/qcom/lpass-platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/soc/qcom/lpass-platform.c
++++ b/sound/soc/qcom/lpass-platform.c
+@@ -78,6 +78,9 @@ static int lpass_platform_pcmops_open(st
+ dma_ch = 0;
+ if (v->alloc_dma_channel)
+ dma_ch = v->alloc_dma_channel(drvdata, dir);
++ else
++ dma_ch = 0;
++
+ if (dma_ch < 0)
+ return dma_ch;
+
--- /dev/null
+From 5faf071d08ddd1c1be66deaa93a09ccf43f5b538 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Fri, 21 Oct 2016 14:18:48 +0100
+Subject: ASoC: samsung: i2s: Fixup last IRQ unsafe spin lock call
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit 5faf071d08ddd1c1be66deaa93a09ccf43f5b538 upstream.
+
+Unfortunately, I seem to have missed a case where an IRQ safe spinlock was
+required, in samsung_i2s_dai_remove, when I fixed up the other calls in
+this patch:
+
+316fa9e09ad7 ("ASoC: samsung: Use IRQ safe spin lock calls")
+
+This causes a lockdep warning when unbinding and rebinding the audio card:
+
+[ 104.357664] CPU0 CPU1
+[ 104.362174] ---- ----
+[ 104.366692] lock(&(&pri_dai->spinlock)->rlock);
+[ 104.371372] local_irq_disable();
+[ 104.377283] lock(&(&substream->self_group.lock)->rlock);
+[ 104.385259] lock(&(&pri_dai->spinlock)->rlock);
+[ 104.392469] <Interrupt>
+[ 104.395072] lock(&(&substream->self_group.lock)->rlock);
+[ 104.400710]
+[ 104.400710] *** DEADLOCK ***
+
+Fixes: ce8bcdbb61d9 ("ASoC: samsung: i2s: Protect more registers with a spinlock")
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/samsung/i2s.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -1029,12 +1029,13 @@ static int samsung_i2s_dai_probe(struct
+ static int samsung_i2s_dai_remove(struct snd_soc_dai *dai)
+ {
+ struct i2s_dai *i2s = snd_soc_dai_get_drvdata(dai);
++ unsigned long flags;
+
+ if (!is_secondary(i2s)) {
+ if (i2s->quirks & QUIRK_NEED_RSTCLR) {
+- spin_lock(i2s->lock);
++ spin_lock_irqsave(i2s->lock, flags);
+ writel(0, i2s->addr + I2SCON);
+- spin_unlock(i2s->lock);
++ spin_unlock_irqrestore(i2s->lock, flags);
+ }
+ }
+
--- /dev/null
+From 20979202ee6e4c68dab7bcf408787225a656d18e Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Thu, 1 Dec 2016 14:25:44 +0800
+Subject: clk: clk-wm831x: fix a logic error
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 20979202ee6e4c68dab7bcf408787225a656d18e upstream.
+
+Fix bug https://bugzilla.kernel.org/show_bug.cgi?id=188561. Function
+wm831x_clkout_is_prepared() returns "true" when it fails to read
+CLOCK_CONTROL_1. "true" means the device is already prepared. So
+return "true" on the read failure seems improper.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Fixes: f05259a6ffa4 ("clk: wm831x: Add initial WM831x clock driver")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk-wm831x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-wm831x.c
++++ b/drivers/clk/clk-wm831x.c
+@@ -243,7 +243,7 @@ static int wm831x_clkout_is_prepared(str
+ if (ret < 0) {
+ dev_err(wm831x->dev, "Unable to read CLOCK_CONTROL_1: %d\n",
+ ret);
+- return true;
++ return false;
+ }
+
+ return (ret & WM831X_CLKOUT_ENA) != 0;
--- /dev/null
+From bae203d58b7dce89664071b3fafe20cedaa3e4f6 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vz@mleia.com>
+Date: Mon, 26 Sep 2016 03:03:42 +0300
+Subject: clk: imx31: fix rewritten input argument of mx31_clocks_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+commit bae203d58b7dce89664071b3fafe20cedaa3e4f6 upstream.
+
+Function mx31_clocks_init() is called during clock intialization on
+legacy boards with reference clock frequency passed as its input
+argument, this can be verified by examination of the function
+declaration found in arch/arm/mach-imx/common.h and actual function
+users which include that header file.
+
+Inside CCF driver the function ignores its input argument, by chance
+the used value in the function body is the same as input arguments on
+side of all callers.
+
+Fixes: d9388c843237 ("clk: imx31: Do not call mxc_timer_init twice when booting with DT")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Acked-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/imx/clk-imx31.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/clk/imx/clk-imx31.c
++++ b/drivers/clk/imx/clk-imx31.c
+@@ -157,10 +157,8 @@ static void __init _mx31_clocks_init(uns
+ }
+ }
+
+-int __init mx31_clocks_init(void)
++int __init mx31_clocks_init(unsigned long fref)
+ {
+- u32 fref = 26000000; /* default */
+-
+ _mx31_clocks_init(fref);
+
+ clk_register_clkdev(clk[gpt_gate], "per", "imx-gpt.0");
--- /dev/null
+From cbf2e548ca8ad4bb274d014e9a70bd841d29948e Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Wed, 9 Nov 2016 17:08:28 -0800
+Subject: clk: qcom: ipq806x: Fix board clk rates
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+commit cbf2e548ca8ad4bb274d014e9a70bd841d29948e upstream.
+
+The clocks on these boards run at 25 MHz, not 19.2 and 27 like
+other platforms. Unfortunately I copy/pasted from other similar
+SoCs but forgot this one is different. Fix it.
+
+Fixes: a085f877a882 ("clk: qcom: Move cxo/pxo/xo into dt files")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/qcom/gcc-ipq806x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/qcom/gcc-ipq806x.c
++++ b/drivers/clk/qcom/gcc-ipq806x.c
+@@ -2990,11 +2990,11 @@ static int gcc_ipq806x_probe(struct plat
+ struct regmap *regmap;
+ int ret;
+
+- ret = qcom_cc_register_board_clk(dev, "cxo_board", "cxo", 19200000);
++ ret = qcom_cc_register_board_clk(dev, "cxo_board", "cxo", 25000000);
+ if (ret)
+ return ret;
+
+- ret = qcom_cc_register_board_clk(dev, "pxo_board", "pxo", 27000000);
++ ret = qcom_cc_register_board_clk(dev, "pxo_board", "pxo", 25000000);
+ if (ret)
+ return ret;
+
--- /dev/null
+From e2a33c34ddff22ee208d80abdd12b88a98d6cb60 Mon Sep 17 00:00:00 2001
+From: Chris Brandt <chris.brandt@renesas.com>
+Date: Thu, 15 Dec 2016 12:00:27 -0500
+Subject: clk: renesas: mstp: Support 8-bit registers for r7s72100
+
+From: Chris Brandt <chris.brandt@renesas.com>
+
+commit e2a33c34ddff22ee208d80abdd12b88a98d6cb60 upstream.
+
+The RZ/A1 is different than the other Renesas SOCs because the MSTP
+registers are 8-bit instead of 32-bit and if you try writing values as
+32-bit nothing happens...meaning this driver never worked for r7s72100.
+
+Fixes: b6face404f38 ("ARM: shmobile: r7s72100: add essential clock nodes to dtsi")
+Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/renesas/clk-mstp.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+--- a/drivers/clk/renesas/clk-mstp.c
++++ b/drivers/clk/renesas/clk-mstp.c
+@@ -37,12 +37,14 @@
+ * @smstpcr: module stop control register
+ * @mstpsr: module stop status register (optional)
+ * @lock: protects writes to SMSTPCR
++ * @width_8bit: registers are 8-bit, not 32-bit
+ */
+ struct mstp_clock_group {
+ struct clk_onecell_data data;
+ void __iomem *smstpcr;
+ void __iomem *mstpsr;
+ spinlock_t lock;
++ bool width_8bit;
+ };
+
+ /**
+@@ -59,6 +61,18 @@ struct mstp_clock {
+
+ #define to_mstp_clock(_hw) container_of(_hw, struct mstp_clock, hw)
+
++static inline u32 cpg_mstp_read(struct mstp_clock_group *group,
++ u32 __iomem *reg)
++{
++ return group->width_8bit ? readb(reg) : clk_readl(reg);
++}
++
++static inline void cpg_mstp_write(struct mstp_clock_group *group, u32 val,
++ u32 __iomem *reg)
++{
++ group->width_8bit ? writeb(val, reg) : clk_writel(val, reg);
++}
++
+ static int cpg_mstp_clock_endisable(struct clk_hw *hw, bool enable)
+ {
+ struct mstp_clock *clock = to_mstp_clock(hw);
+@@ -70,12 +84,12 @@ static int cpg_mstp_clock_endisable(stru
+
+ spin_lock_irqsave(&group->lock, flags);
+
+- value = clk_readl(group->smstpcr);
++ value = cpg_mstp_read(group, group->smstpcr);
+ if (enable)
+ value &= ~bitmask;
+ else
+ value |= bitmask;
+- clk_writel(value, group->smstpcr);
++ cpg_mstp_write(group, value, group->smstpcr);
+
+ spin_unlock_irqrestore(&group->lock, flags);
+
+@@ -83,7 +97,7 @@ static int cpg_mstp_clock_endisable(stru
+ return 0;
+
+ for (i = 1000; i > 0; --i) {
+- if (!(clk_readl(group->mstpsr) & bitmask))
++ if (!(cpg_mstp_read(group, group->mstpsr) & bitmask))
+ break;
+ cpu_relax();
+ }
+@@ -114,9 +128,9 @@ static int cpg_mstp_clock_is_enabled(str
+ u32 value;
+
+ if (group->mstpsr)
+- value = clk_readl(group->mstpsr);
++ value = cpg_mstp_read(group, group->mstpsr);
+ else
+- value = clk_readl(group->smstpcr);
++ value = cpg_mstp_read(group, group->smstpcr);
+
+ return !(value & BIT(clock->bit_index));
+ }
+@@ -188,6 +202,9 @@ static void __init cpg_mstp_clocks_init(
+ return;
+ }
+
++ if (of_device_is_compatible(np, "renesas,r7s72100-mstp-clocks"))
++ group->width_8bit = true;
++
+ for (i = 0; i < MSTP_MAX_CLOCKS; ++i)
+ clks[i] = ERR_PTR(-ENOENT);
+
--- /dev/null
+From 937ff9ded8b6ebe8963ade55bdd77a61ded88075 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Fri, 11 Nov 2016 18:05:57 +0800
+Subject: clk: sunxi-ng: sun8i-a23: Set CLK_SET_RATE_PARENT for audio module clocks
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 937ff9ded8b6ebe8963ade55bdd77a61ded88075 upstream.
+
+The audio module clocks are supposed to be set according to the sample
+rate of the audio stream. The audio PLL provides the clock signal for
+these module clocks, and only it is freely tunable.
+
+Set CLK_SET_RATE_PARENT for the audio module clocks so their users can
+properly tune the clock rate.
+
+Fixes: 5690879d93e8 ("clk: sunxi-ng: Add A23 CCU")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-a23.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+@@ -344,10 +344,10 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_c
+ static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x",
+ "pll-audio-2x", "pll-audio" };
+ static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents,
+- 0x0b0, 16, 2, BIT(31), 0);
++ 0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents,
+- 0x0b4, 16, 2, BIT(31), 0);
++ 0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
+
+ /* TODO: the parent for most of the USB clocks is not known */
+ static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M",
+@@ -415,7 +415,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve
+ 0x13c, 16, 3, BIT(31), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_GATE(ac_dig_clk, "ac-dig", "pll-audio",
+- 0x140, BIT(31), 0);
++ 0x140, BIT(31), CLK_SET_RATE_PARENT);
+ static SUNXI_CCU_GATE(avs_clk, "avs", "osc24M",
+ 0x144, BIT(31), 0);
+
--- /dev/null
+From 0f6f9302b819ca352cfd4f42c18ec08d521f9cae Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Fri, 11 Nov 2016 18:05:58 +0800
+Subject: clk: sunxi-ng: sun8i-h3: Set CLK_SET_RATE_PARENT for audio module clocks
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 0f6f9302b819ca352cfd4f42c18ec08d521f9cae upstream.
+
+The audio module clocks are supposed to be set according to the sample
+rate of the audio stream. The audio PLL provides the clock signal for
+these module clocks, and only it is freely tunable.
+
+Set CLK_SET_RATE_PARENT for the audio module clocks so their users can
+properly tune the clock rate.
+
+Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+@@ -394,16 +394,16 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_c
+ static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x",
+ "pll-audio-2x", "pll-audio" };
+ static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents,
+- 0x0b0, 16, 2, BIT(31), 0);
++ 0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents,
+- 0x0b4, 16, 2, BIT(31), 0);
++ 0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_MUX_WITH_GATE(i2s2_clk, "i2s2", i2s_parents,
+- 0x0b8, 16, 2, BIT(31), 0);
++ 0x0b8, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_M_WITH_GATE(spdif_clk, "spdif", "pll-audio",
+- 0x0c0, 0, 4, BIT(31), 0);
++ 0x0c0, 0, 4, BIT(31), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M",
+ 0x0cc, BIT(8), 0);
+@@ -466,7 +466,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve
+ 0x13c, 16, 3, BIT(31), 0);
+
+ static SUNXI_CCU_GATE(ac_dig_clk, "ac-dig", "pll-audio",
+- 0x140, BIT(31), 0);
++ 0x140, BIT(31), CLK_SET_RATE_PARENT);
+ static SUNXI_CCU_GATE(avs_clk, "avs", "osc24M",
+ 0x144, BIT(31), 0);
+
--- /dev/null
+From f8d17344a60921c2387759fc0a85aa64299d1ec6 Mon Sep 17 00:00:00 2001
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Tue, 29 Nov 2016 17:07:57 -0600
+Subject: clk: ti: dra7: fix "failed to lookup clock node gmac_gmii_ref_clk_div" boot message
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+commit f8d17344a60921c2387759fc0a85aa64299d1ec6 upstream.
+
+Prevent creating clk alias for non existing gmac_gmii_ref_clk_div clock and,
+this way, eliminate excessive error message during boot:
+
+ "ti_dt_clocks_register: failed to lookup clock node gmac_gmii_ref_clk_div"
+
+Fixes: c097338ebd3f ("ARM: dts: dra7: cpsw: fix clocks tree")
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/ti/clk-7xx.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/clk/ti/clk-7xx.c
++++ b/drivers/clk/ti/clk-7xx.c
+@@ -201,7 +201,6 @@ static struct ti_dt_clk dra7xx_clks[] =
+ DT_CLK(NULL, "atl_dpll_clk_mux", "atl_dpll_clk_mux"),
+ DT_CLK(NULL, "atl_gfclk_mux", "atl_gfclk_mux"),
+ DT_CLK(NULL, "dcan1_sys_clk_mux", "dcan1_sys_clk_mux"),
+- DT_CLK(NULL, "gmac_gmii_ref_clk_div", "gmac_gmii_ref_clk_div"),
+ DT_CLK(NULL, "gmac_rft_clk_mux", "gmac_rft_clk_mux"),
+ DT_CLK(NULL, "gpu_core_gclk_mux", "gpu_core_gclk_mux"),
+ DT_CLK(NULL, "gpu_hyd_gclk_mux", "gpu_hyd_gclk_mux"),
--- /dev/null
+From 58010fa6f71c9577922b22e46014b95a4ec80fa0 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 11 Oct 2016 19:15:20 +0100
+Subject: crypto: arm/aes-ce - fix for big endian
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit 58010fa6f71c9577922b22e46014b95a4ec80fa0 upstream.
+
+The AES key schedule generation is mostly endian agnostic, with the
+exception of the rotation and the incorporation of the round constant
+at the start of each round. So implement a big endian specific version
+of that part to make the whole routine big endian compatible.
+
+Fixes: 86464859cc77 ("crypto: arm - AES in ECB/CBC/CTR/XTS modes using ARMv8 Crypto Extensions")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/crypto/aes-ce-glue.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm/crypto/aes-ce-glue.c
++++ b/arch/arm/crypto/aes-ce-glue.c
+@@ -88,8 +88,13 @@ static int ce_aes_expandkey(struct crypt
+ u32 *rki = ctx->key_enc + (i * kwords);
+ u32 *rko = rki + kwords;
+
++#ifndef CONFIG_CPU_BIG_ENDIAN
+ rko[0] = ror32(ce_aes_sub(rki[kwords - 1]), 8);
+ rko[0] = rko[0] ^ rki[0] ^ rcon[i];
++#else
++ rko[0] = rol32(ce_aes_sub(rki[kwords - 1]), 8);
++ rko[0] = rko[0] ^ rki[0] ^ (rcon[i] << 24);
++#endif
+ rko[1] = rko[0] ^ rki[1];
+ rko[2] = rko[1] ^ rki[2];
+ rko[3] = rko[2] ^ rki[3];
--- /dev/null
+From 56e4e76c68fcb51547b5299e5b66a135935ff414 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 11 Oct 2016 19:15:17 +0100
+Subject: crypto: arm64/aes-ccm-ce: fix for big endian
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit 56e4e76c68fcb51547b5299e5b66a135935ff414 upstream.
+
+The AES-CCM implementation that uses ARMv8 Crypto Extensions instructions
+refers to the AES round keys as pairs of 64-bit quantities, which causes
+failures when building the code for big endian. In addition, it byte swaps
+the input counter unconditionally, while this is only required for little
+endian builds. So fix both issues.
+
+Fixes: 12ac3efe74f8 ("arm64/crypto: use crypto instructions to generate AES key schedule")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/crypto/aes-ce-ccm-core.S | 53 ++++++++++++++++++------------------
+ 1 file changed, 27 insertions(+), 26 deletions(-)
+
+--- a/arch/arm64/crypto/aes-ce-ccm-core.S
++++ b/arch/arm64/crypto/aes-ce-ccm-core.S
+@@ -9,6 +9,7 @@
+ */
+
+ #include <linux/linkage.h>
++#include <asm/assembler.h>
+
+ .text
+ .arch armv8-a+crypto
+@@ -19,7 +20,7 @@
+ */
+ ENTRY(ce_aes_ccm_auth_data)
+ ldr w8, [x3] /* leftover from prev round? */
+- ld1 {v0.2d}, [x0] /* load mac */
++ ld1 {v0.16b}, [x0] /* load mac */
+ cbz w8, 1f
+ sub w8, w8, #16
+ eor v1.16b, v1.16b, v1.16b
+@@ -31,7 +32,7 @@ ENTRY(ce_aes_ccm_auth_data)
+ beq 8f /* out of input? */
+ cbnz w8, 0b
+ eor v0.16b, v0.16b, v1.16b
+-1: ld1 {v3.2d}, [x4] /* load first round key */
++1: ld1 {v3.16b}, [x4] /* load first round key */
+ prfm pldl1strm, [x1]
+ cmp w5, #12 /* which key size? */
+ add x6, x4, #16
+@@ -41,17 +42,17 @@ ENTRY(ce_aes_ccm_auth_data)
+ mov v5.16b, v3.16b
+ b 4f
+ 2: mov v4.16b, v3.16b
+- ld1 {v5.2d}, [x6], #16 /* load 2nd round key */
++ ld1 {v5.16b}, [x6], #16 /* load 2nd round key */
+ 3: aese v0.16b, v4.16b
+ aesmc v0.16b, v0.16b
+-4: ld1 {v3.2d}, [x6], #16 /* load next round key */
++4: ld1 {v3.16b}, [x6], #16 /* load next round key */
+ aese v0.16b, v5.16b
+ aesmc v0.16b, v0.16b
+-5: ld1 {v4.2d}, [x6], #16 /* load next round key */
++5: ld1 {v4.16b}, [x6], #16 /* load next round key */
+ subs w7, w7, #3
+ aese v0.16b, v3.16b
+ aesmc v0.16b, v0.16b
+- ld1 {v5.2d}, [x6], #16 /* load next round key */
++ ld1 {v5.16b}, [x6], #16 /* load next round key */
+ bpl 3b
+ aese v0.16b, v4.16b
+ subs w2, w2, #16 /* last data? */
+@@ -60,7 +61,7 @@ ENTRY(ce_aes_ccm_auth_data)
+ ld1 {v1.16b}, [x1], #16 /* load next input block */
+ eor v0.16b, v0.16b, v1.16b /* xor with mac */
+ bne 1b
+-6: st1 {v0.2d}, [x0] /* store mac */
++6: st1 {v0.16b}, [x0] /* store mac */
+ beq 10f
+ adds w2, w2, #16
+ beq 10f
+@@ -79,7 +80,7 @@ ENTRY(ce_aes_ccm_auth_data)
+ adds w7, w7, #1
+ bne 9b
+ eor v0.16b, v0.16b, v1.16b
+- st1 {v0.2d}, [x0]
++ st1 {v0.16b}, [x0]
+ 10: str w8, [x3]
+ ret
+ ENDPROC(ce_aes_ccm_auth_data)
+@@ -89,27 +90,27 @@ ENDPROC(ce_aes_ccm_auth_data)
+ * u32 rounds);
+ */
+ ENTRY(ce_aes_ccm_final)
+- ld1 {v3.2d}, [x2], #16 /* load first round key */
+- ld1 {v0.2d}, [x0] /* load mac */
++ ld1 {v3.16b}, [x2], #16 /* load first round key */
++ ld1 {v0.16b}, [x0] /* load mac */
+ cmp w3, #12 /* which key size? */
+ sub w3, w3, #2 /* modified # of rounds */
+- ld1 {v1.2d}, [x1] /* load 1st ctriv */
++ ld1 {v1.16b}, [x1] /* load 1st ctriv */
+ bmi 0f
+ bne 3f
+ mov v5.16b, v3.16b
+ b 2f
+ 0: mov v4.16b, v3.16b
+-1: ld1 {v5.2d}, [x2], #16 /* load next round key */
++1: ld1 {v5.16b}, [x2], #16 /* load next round key */
+ aese v0.16b, v4.16b
+ aesmc v0.16b, v0.16b
+ aese v1.16b, v4.16b
+ aesmc v1.16b, v1.16b
+-2: ld1 {v3.2d}, [x2], #16 /* load next round key */
++2: ld1 {v3.16b}, [x2], #16 /* load next round key */
+ aese v0.16b, v5.16b
+ aesmc v0.16b, v0.16b
+ aese v1.16b, v5.16b
+ aesmc v1.16b, v1.16b
+-3: ld1 {v4.2d}, [x2], #16 /* load next round key */
++3: ld1 {v4.16b}, [x2], #16 /* load next round key */
+ subs w3, w3, #3
+ aese v0.16b, v3.16b
+ aesmc v0.16b, v0.16b
+@@ -120,47 +121,47 @@ ENTRY(ce_aes_ccm_final)
+ aese v1.16b, v4.16b
+ /* final round key cancels out */
+ eor v0.16b, v0.16b, v1.16b /* en-/decrypt the mac */
+- st1 {v0.2d}, [x0] /* store result */
++ st1 {v0.16b}, [x0] /* store result */
+ ret
+ ENDPROC(ce_aes_ccm_final)
+
+ .macro aes_ccm_do_crypt,enc
+ ldr x8, [x6, #8] /* load lower ctr */
+- ld1 {v0.2d}, [x5] /* load mac */
+- rev x8, x8 /* keep swabbed ctr in reg */
++ ld1 {v0.16b}, [x5] /* load mac */
++CPU_LE( rev x8, x8 ) /* keep swabbed ctr in reg */
+ 0: /* outer loop */
+- ld1 {v1.1d}, [x6] /* load upper ctr */
++ ld1 {v1.8b}, [x6] /* load upper ctr */
+ prfm pldl1strm, [x1]
+ add x8, x8, #1
+ rev x9, x8
+ cmp w4, #12 /* which key size? */
+ sub w7, w4, #2 /* get modified # of rounds */
+ ins v1.d[1], x9 /* no carry in lower ctr */
+- ld1 {v3.2d}, [x3] /* load first round key */
++ ld1 {v3.16b}, [x3] /* load first round key */
+ add x10, x3, #16
+ bmi 1f
+ bne 4f
+ mov v5.16b, v3.16b
+ b 3f
+ 1: mov v4.16b, v3.16b
+- ld1 {v5.2d}, [x10], #16 /* load 2nd round key */
++ ld1 {v5.16b}, [x10], #16 /* load 2nd round key */
+ 2: /* inner loop: 3 rounds, 2x interleaved */
+ aese v0.16b, v4.16b
+ aesmc v0.16b, v0.16b
+ aese v1.16b, v4.16b
+ aesmc v1.16b, v1.16b
+-3: ld1 {v3.2d}, [x10], #16 /* load next round key */
++3: ld1 {v3.16b}, [x10], #16 /* load next round key */
+ aese v0.16b, v5.16b
+ aesmc v0.16b, v0.16b
+ aese v1.16b, v5.16b
+ aesmc v1.16b, v1.16b
+-4: ld1 {v4.2d}, [x10], #16 /* load next round key */
++4: ld1 {v4.16b}, [x10], #16 /* load next round key */
+ subs w7, w7, #3
+ aese v0.16b, v3.16b
+ aesmc v0.16b, v0.16b
+ aese v1.16b, v3.16b
+ aesmc v1.16b, v1.16b
+- ld1 {v5.2d}, [x10], #16 /* load next round key */
++ ld1 {v5.16b}, [x10], #16 /* load next round key */
+ bpl 2b
+ aese v0.16b, v4.16b
+ aese v1.16b, v4.16b
+@@ -177,14 +178,14 @@ ENDPROC(ce_aes_ccm_final)
+ eor v0.16b, v0.16b, v2.16b /* xor mac with pt ^ rk[last] */
+ st1 {v1.16b}, [x0], #16 /* write output block */
+ bne 0b
+- rev x8, x8
+- st1 {v0.2d}, [x5] /* store mac */
++CPU_LE( rev x8, x8 )
++ st1 {v0.16b}, [x5] /* store mac */
+ str x8, [x6, #8] /* store lsb end of ctr (BE) */
+ 5: ret
+
+ 6: eor v0.16b, v0.16b, v5.16b /* final round mac */
+ eor v1.16b, v1.16b, v5.16b /* final round enc */
+- st1 {v0.2d}, [x5] /* store mac */
++ st1 {v0.16b}, [x5] /* store mac */
+ add w2, w2, #16 /* process partial tail block */
+ 7: ldrb w9, [x1], #1 /* get 1 byte of input */
+ umov w6, v1.b[0] /* get top crypted ctr byte */
--- /dev/null
+From 1803b9a52c4e5a5dbb8a27126f6bc06939359753 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 11 Oct 2016 19:15:13 +0100
+Subject: crypto: arm64/aes-ce - fix for big endian
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit 1803b9a52c4e5a5dbb8a27126f6bc06939359753 upstream.
+
+The core AES cipher implementation that uses ARMv8 Crypto Extensions
+instructions erroneously loads the round keys as 64-bit quantities,
+which causes the algorithm to fail when built for big endian. In
+addition, the key schedule generation routine fails to take endianness
+into account as well, when loading the combining the input key with
+the round constants. So fix both issues.
+
+Fixes: 12ac3efe74f8 ("arm64/crypto: use crypto instructions to generate AES key schedule")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/crypto/aes-ce-cipher.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/arch/arm64/crypto/aes-ce-cipher.c
++++ b/arch/arm64/crypto/aes-ce-cipher.c
+@@ -47,24 +47,24 @@ static void aes_cipher_encrypt(struct cr
+ kernel_neon_begin_partial(4);
+
+ __asm__(" ld1 {v0.16b}, %[in] ;"
+- " ld1 {v1.2d}, [%[key]], #16 ;"
++ " ld1 {v1.16b}, [%[key]], #16 ;"
+ " cmp %w[rounds], #10 ;"
+ " bmi 0f ;"
+ " bne 3f ;"
+ " mov v3.16b, v1.16b ;"
+ " b 2f ;"
+ "0: mov v2.16b, v1.16b ;"
+- " ld1 {v3.2d}, [%[key]], #16 ;"
++ " ld1 {v3.16b}, [%[key]], #16 ;"
+ "1: aese v0.16b, v2.16b ;"
+ " aesmc v0.16b, v0.16b ;"
+- "2: ld1 {v1.2d}, [%[key]], #16 ;"
++ "2: ld1 {v1.16b}, [%[key]], #16 ;"
+ " aese v0.16b, v3.16b ;"
+ " aesmc v0.16b, v0.16b ;"
+- "3: ld1 {v2.2d}, [%[key]], #16 ;"
++ "3: ld1 {v2.16b}, [%[key]], #16 ;"
+ " subs %w[rounds], %w[rounds], #3 ;"
+ " aese v0.16b, v1.16b ;"
+ " aesmc v0.16b, v0.16b ;"
+- " ld1 {v3.2d}, [%[key]], #16 ;"
++ " ld1 {v3.16b}, [%[key]], #16 ;"
+ " bpl 1b ;"
+ " aese v0.16b, v2.16b ;"
+ " eor v0.16b, v0.16b, v3.16b ;"
+@@ -92,24 +92,24 @@ static void aes_cipher_decrypt(struct cr
+ kernel_neon_begin_partial(4);
+
+ __asm__(" ld1 {v0.16b}, %[in] ;"
+- " ld1 {v1.2d}, [%[key]], #16 ;"
++ " ld1 {v1.16b}, [%[key]], #16 ;"
+ " cmp %w[rounds], #10 ;"
+ " bmi 0f ;"
+ " bne 3f ;"
+ " mov v3.16b, v1.16b ;"
+ " b 2f ;"
+ "0: mov v2.16b, v1.16b ;"
+- " ld1 {v3.2d}, [%[key]], #16 ;"
++ " ld1 {v3.16b}, [%[key]], #16 ;"
+ "1: aesd v0.16b, v2.16b ;"
+ " aesimc v0.16b, v0.16b ;"
+- "2: ld1 {v1.2d}, [%[key]], #16 ;"
++ "2: ld1 {v1.16b}, [%[key]], #16 ;"
+ " aesd v0.16b, v3.16b ;"
+ " aesimc v0.16b, v0.16b ;"
+- "3: ld1 {v2.2d}, [%[key]], #16 ;"
++ "3: ld1 {v2.16b}, [%[key]], #16 ;"
+ " subs %w[rounds], %w[rounds], #3 ;"
+ " aesd v0.16b, v1.16b ;"
+ " aesimc v0.16b, v0.16b ;"
+- " ld1 {v3.2d}, [%[key]], #16 ;"
++ " ld1 {v3.16b}, [%[key]], #16 ;"
+ " bpl 1b ;"
+ " aesd v0.16b, v2.16b ;"
+ " eor v0.16b, v0.16b, v3.16b ;"
+@@ -173,7 +173,12 @@ int ce_aes_expandkey(struct crypto_aes_c
+ u32 *rki = ctx->key_enc + (i * kwords);
+ u32 *rko = rki + kwords;
+
++#ifndef CONFIG_CPU_BIG_ENDIAN
+ rko[0] = ror32(aes_sub(rki[kwords - 1]), 8) ^ rcon[i] ^ rki[0];
++#else
++ rko[0] = rol32(aes_sub(rki[kwords - 1]), 8) ^ (rcon[i] << 24) ^
++ rki[0];
++#endif
+ rko[1] = rko[0] ^ rki[1];
+ rko[2] = rko[1] ^ rki[2];
+ rko[3] = rko[2] ^ rki[3];
--- /dev/null
+From a2c435cc99862fd3d165e1b66bf48ac72c839c62 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 11 Oct 2016 19:15:18 +0100
+Subject: crypto: arm64/aes-neon - fix for big endian
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit a2c435cc99862fd3d165e1b66bf48ac72c839c62 upstream.
+
+The AES implementation using pure NEON instructions relies on the generic
+AES key schedule generation routines, which store the round keys as arrays
+of 32-bit quantities stored in memory using native endianness. This means
+we should refer to these round keys using 4x4 loads rather than 16x1 loads.
+In addition, the ShiftRows tables are loading using a single scalar load,
+which is also affected by endianness, so emit these tables in the correct
+order depending on whether we are building for big endian or not.
+
+Fixes: 49788fe2a128 ("arm64/crypto: AES-ECB/CBC/CTR/XTS using ARMv8 NEON and Crypto Extensions")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/crypto/aes-neon.S | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/arch/arm64/crypto/aes-neon.S
++++ b/arch/arm64/crypto/aes-neon.S
+@@ -9,6 +9,7 @@
+ */
+
+ #include <linux/linkage.h>
++#include <asm/assembler.h>
+
+ #define AES_ENTRY(func) ENTRY(neon_ ## func)
+ #define AES_ENDPROC(func) ENDPROC(neon_ ## func)
+@@ -83,13 +84,13 @@
+ .endm
+
+ .macro do_block, enc, in, rounds, rk, rkp, i
+- ld1 {v15.16b}, [\rk]
++ ld1 {v15.4s}, [\rk]
+ add \rkp, \rk, #16
+ mov \i, \rounds
+ 1111: eor \in\().16b, \in\().16b, v15.16b /* ^round key */
+ tbl \in\().16b, {\in\().16b}, v13.16b /* ShiftRows */
+ sub_bytes \in
+- ld1 {v15.16b}, [\rkp], #16
++ ld1 {v15.4s}, [\rkp], #16
+ subs \i, \i, #1
+ beq 2222f
+ .if \enc == 1
+@@ -229,7 +230,7 @@
+ .endm
+
+ .macro do_block_2x, enc, in0, in1 rounds, rk, rkp, i
+- ld1 {v15.16b}, [\rk]
++ ld1 {v15.4s}, [\rk]
+ add \rkp, \rk, #16
+ mov \i, \rounds
+ 1111: eor \in0\().16b, \in0\().16b, v15.16b /* ^round key */
+@@ -237,7 +238,7 @@
+ sub_bytes_2x \in0, \in1
+ tbl \in0\().16b, {\in0\().16b}, v13.16b /* ShiftRows */
+ tbl \in1\().16b, {\in1\().16b}, v13.16b /* ShiftRows */
+- ld1 {v15.16b}, [\rkp], #16
++ ld1 {v15.4s}, [\rkp], #16
+ subs \i, \i, #1
+ beq 2222f
+ .if \enc == 1
+@@ -254,7 +255,7 @@
+ .endm
+
+ .macro do_block_4x, enc, in0, in1, in2, in3, rounds, rk, rkp, i
+- ld1 {v15.16b}, [\rk]
++ ld1 {v15.4s}, [\rk]
+ add \rkp, \rk, #16
+ mov \i, \rounds
+ 1111: eor \in0\().16b, \in0\().16b, v15.16b /* ^round key */
+@@ -266,7 +267,7 @@
+ tbl \in1\().16b, {\in1\().16b}, v13.16b /* ShiftRows */
+ tbl \in2\().16b, {\in2\().16b}, v13.16b /* ShiftRows */
+ tbl \in3\().16b, {\in3\().16b}, v13.16b /* ShiftRows */
+- ld1 {v15.16b}, [\rkp], #16
++ ld1 {v15.4s}, [\rkp], #16
+ subs \i, \i, #1
+ beq 2222f
+ .if \enc == 1
+@@ -306,12 +307,16 @@
+ .text
+ .align 4
+ .LForward_ShiftRows:
+- .byte 0x0, 0x5, 0xa, 0xf, 0x4, 0x9, 0xe, 0x3
+- .byte 0x8, 0xd, 0x2, 0x7, 0xc, 0x1, 0x6, 0xb
++CPU_LE( .byte 0x0, 0x5, 0xa, 0xf, 0x4, 0x9, 0xe, 0x3 )
++CPU_LE( .byte 0x8, 0xd, 0x2, 0x7, 0xc, 0x1, 0x6, 0xb )
++CPU_BE( .byte 0xb, 0x6, 0x1, 0xc, 0x7, 0x2, 0xd, 0x8 )
++CPU_BE( .byte 0x3, 0xe, 0x9, 0x4, 0xf, 0xa, 0x5, 0x0 )
+
+ .LReverse_ShiftRows:
+- .byte 0x0, 0xd, 0xa, 0x7, 0x4, 0x1, 0xe, 0xb
+- .byte 0x8, 0x5, 0x2, 0xf, 0xc, 0x9, 0x6, 0x3
++CPU_LE( .byte 0x0, 0xd, 0xa, 0x7, 0x4, 0x1, 0xe, 0xb )
++CPU_LE( .byte 0x8, 0x5, 0x2, 0xf, 0xc, 0x9, 0x6, 0x3 )
++CPU_BE( .byte 0x3, 0x6, 0x9, 0xc, 0xf, 0x2, 0x5, 0x8 )
++CPU_BE( .byte 0xb, 0xe, 0x1, 0x4, 0x7, 0xa, 0xd, 0x0 )
+
+ .LForward_Sbox:
+ .byte 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5
--- /dev/null
+From caf4b9e2b326cc2a5005a5c557274306536ace61 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 11 Oct 2016 19:15:19 +0100
+Subject: crypto: arm64/aes-xts-ce: fix for big endian
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit caf4b9e2b326cc2a5005a5c557274306536ace61 upstream.
+
+Emit the XTS tweak literal constants in the appropriate order for a
+single 128-bit scalar literal load.
+
+Fixes: 49788fe2a128 ("arm64/crypto: AES-ECB/CBC/CTR/XTS using ARMv8 NEON and Crypto Extensions")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/crypto/aes-ce.S | 1 +
+ arch/arm64/crypto/aes-modes.S | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/crypto/aes-ce.S
++++ b/arch/arm64/crypto/aes-ce.S
+@@ -10,6 +10,7 @@
+ */
+
+ #include <linux/linkage.h>
++#include <asm/assembler.h>
+
+ #define AES_ENTRY(func) ENTRY(ce_ ## func)
+ #define AES_ENDPROC(func) ENDPROC(ce_ ## func)
+--- a/arch/arm64/crypto/aes-modes.S
++++ b/arch/arm64/crypto/aes-modes.S
+@@ -386,7 +386,8 @@ AES_ENDPROC(aes_ctr_encrypt)
+ .endm
+
+ .Lxts_mul_x:
+- .word 1, 0, 0x87, 0
++CPU_LE( .quad 1, 0x87 )
++CPU_BE( .quad 0x87, 1 )
+
+ AES_ENTRY(aes_xts_encrypt)
+ FRAME_PUSH
--- /dev/null
+From 9c433ad5083fd4a4a3c721d86cbfbd0b2a2326a5 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 11 Oct 2016 19:15:14 +0100
+Subject: crypto: arm64/ghash-ce - fix for big endian
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit 9c433ad5083fd4a4a3c721d86cbfbd0b2a2326a5 upstream.
+
+The GHASH key and digest are both pairs of 64-bit quantities, but the
+GHASH code does not always refer to them as such, causing failures when
+built for big endian. So replace the 16x1 loads and stores with 2x8 ones.
+
+Fixes: b913a6404ce2 ("arm64/crypto: improve performance of GHASH algorithm")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/crypto/ghash-ce-core.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/crypto/ghash-ce-core.S
++++ b/arch/arm64/crypto/ghash-ce-core.S
+@@ -29,8 +29,8 @@
+ * struct ghash_key const *k, const char *head)
+ */
+ ENTRY(pmull_ghash_update)
+- ld1 {SHASH.16b}, [x3]
+- ld1 {XL.16b}, [x1]
++ ld1 {SHASH.2d}, [x3]
++ ld1 {XL.2d}, [x1]
+ movi MASK.16b, #0xe1
+ ext SHASH2.16b, SHASH.16b, SHASH.16b, #8
+ shl MASK.2d, MASK.2d, #57
+@@ -74,6 +74,6 @@ CPU_LE( rev64 T1.16b, T1.16b )
+
+ cbnz w0, 0b
+
+- st1 {XL.16b}, [x1]
++ st1 {XL.2d}, [x1]
+ ret
+ ENDPROC(pmull_ghash_update)
--- /dev/null
+From ee71e5f1e7d25543ee63a80451871f8985b8d431 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 11 Oct 2016 19:15:15 +0100
+Subject: crypto: arm64/sha1-ce - fix for big endian
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit ee71e5f1e7d25543ee63a80451871f8985b8d431 upstream.
+
+The SHA1 digest is an array of 5 32-bit quantities, so we should refer
+to them as such in order for this code to work correctly when built for
+big endian. So replace 16 byte scalar loads and stores with 4x4 vector
+ones where appropriate.
+
+Fixes: 2c98833a42cd ("arm64/crypto: SHA-1 using ARMv8 Crypto Extensions")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/crypto/sha1-ce-core.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/crypto/sha1-ce-core.S
++++ b/arch/arm64/crypto/sha1-ce-core.S
+@@ -78,7 +78,7 @@ ENTRY(sha1_ce_transform)
+ ld1r {k3.4s}, [x6]
+
+ /* load state */
+- ldr dga, [x0]
++ ld1 {dgav.4s}, [x0]
+ ldr dgb, [x0, #16]
+
+ /* load sha1_ce_state::finalize */
+@@ -144,7 +144,7 @@ CPU_LE( rev32 v11.16b, v11.16b )
+ b 1b
+
+ /* store new state */
+-3: str dga, [x0]
++3: st1 {dgav.4s}, [x0]
+ str dgb, [x0, #16]
+ ret
+ ENDPROC(sha1_ce_transform)
--- /dev/null
+From 174122c39c369ed924d2608fc0be0171997ce800 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Tue, 11 Oct 2016 19:15:16 +0100
+Subject: crypto: arm64/sha2-ce - fix for big endian
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+commit 174122c39c369ed924d2608fc0be0171997ce800 upstream.
+
+The SHA256 digest is an array of 8 32-bit quantities, so we should refer
+to them as such in order for this code to work correctly when built for
+big endian. So replace 16 byte scalar loads and stores with 4x32 vector
+ones where appropriate.
+
+Fixes: 6ba6c74dfc6b ("arm64/crypto: SHA-224/SHA-256 using ARMv8 Crypto Extensions")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/crypto/sha2-ce-core.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/crypto/sha2-ce-core.S
++++ b/arch/arm64/crypto/sha2-ce-core.S
+@@ -85,7 +85,7 @@ ENTRY(sha2_ce_transform)
+ ld1 {v12.4s-v15.4s}, [x8]
+
+ /* load state */
+- ldp dga, dgb, [x0]
++ ld1 {dgav.4s, dgbv.4s}, [x0]
+
+ /* load sha256_ce_state::finalize */
+ ldr w4, [x0, #:lo12:sha256_ce_offsetof_finalize]
+@@ -148,6 +148,6 @@ CPU_LE( rev32 v19.16b, v19.16b )
+ b 1b
+
+ /* store new state */
+-3: stp dga, dgb, [x0]
++3: st1 {dgav.4s, dgbv.4s}, [x0]
+ ret
+ ENDPROC(sha2_ce_transform)
--- /dev/null
+From e2a91f4f42018994d7424d405900d17eba6555d0 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Mon, 14 Nov 2016 14:32:27 -0200
+Subject: docs-rst: fix LaTeX \DURole renewcommand with Sphinx 1.3+
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit e2a91f4f42018994d7424d405900d17eba6555d0 upstream.
+
+PDF build on Kernel 4.9-rc? returns an error with Sphinx 1.3.x
+and Sphinx 1.4.x, when trying to solve some cross-references.
+
+The solution is to redefine the \DURole macro.
+
+However, this is redefined too late. Move such redefinition to
+LaTeX preamble and bind it to just the Sphinx versions where the
+error is known to be present.
+
+Tested by building the documentation on interactive mode:
+ make PDFLATEX=xelatex -C Documentation/output/./latex
+
+Fixes: e61a39baf74d ("[media] index.rst: Fix LaTeX error in interactive mode on Sphinx 1.4.x")
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/conf.py | 6 +++++-
+ Documentation/media/index.rst | 5 -----
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+--- a/Documentation/conf.py
++++ b/Documentation/conf.py
+@@ -37,7 +37,7 @@ from load_config import loadConfig
+ extensions = ['kernel-doc', 'rstFlatTable', 'kernel_include', 'cdomain']
+
+ # The name of the math extension changed on Sphinx 1.4
+-if minor > 3:
++if major == 1 and minor > 3:
+ extensions.append("sphinx.ext.imgmath")
+ else:
+ extensions.append("sphinx.ext.pngmath")
+@@ -332,6 +332,10 @@ latex_elements = {
+ '''
+ }
+
++# Fix reference escape troubles with Sphinx 1.4.x
++if major == 1 and minor > 3:
++ latex_elements['preamble'] += '\\renewcommand*{\\DUrole}[2]{ #2 }\n'
++
+ # Grouping the document tree into LaTeX files. List of tuples
+ # (source start file, target name, title,
+ # author, documentclass [howto, manual, or own class]).
+--- a/Documentation/media/index.rst
++++ b/Documentation/media/index.rst
+@@ -1,11 +1,6 @@
+ Linux Media Subsystem Documentation
+ ===================================
+
+-.. Sphinx 1.4.x has a definition for DUrole that doesn't work on alltt blocks
+-.. raw:: latex
+-
+- \renewcommand*{\DUrole}[2]{ #2 }
+-
+ Contents:
+
+ .. toctree::
--- /dev/null
+From 230436b3ef3fd7d4a1da19edf5e87bb2d74e0fc2 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 2 Nov 2016 14:52:15 +0100
+Subject: f2fs: hide a maybe-uninitialized warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 230436b3ef3fd7d4a1da19edf5e87bb2d74e0fc2 upstream.
+
+gcc is unsure about the use of last_ofs_in_node, which might happen
+without a prior initialization:
+
+fs/f2fs//git/arm-soc/fs/f2fs/data.c: In function ‘f2fs_map_blocks’:
+fs/f2fs/data.c:799:54: warning: ‘last_ofs_in_node’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+ if (prealloc && dn.ofs_in_node != last_ofs_in_node + 1) {
+
+As pointed out by Chao Yu, the code is actually correct as 'prealloc'
+is only set if the last_ofs_in_node has been set, the two always
+get updated together.
+
+This initializes last_ofs_in_node to dn.ofs_in_node for each
+new dnode at the start of the 'next_block' loop, which at that
+point is a correct initialization as well. I assume that compilers
+that correctly track the contents of the variables and do not
+warn about the condition also figure out that they can eliminate
+the extra assignment here.
+
+Fixes: 46008c6d4232 ("f2fs: support in batch multi blocks preallocation")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/f2fs/data.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -716,7 +716,7 @@ next_dnode:
+ }
+
+ prealloc = 0;
+- ofs_in_node = dn.ofs_in_node;
++ last_ofs_in_node = ofs_in_node = dn.ofs_in_node;
+ end_offset = ADDRS_PER_PAGE(dn.node_page, inode);
+
+ next_block:
--- /dev/null
+From 35782b233f37e48ecc469d9c7232f3f6a7fad41a Mon Sep 17 00:00:00 2001
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+Date: Thu, 20 Oct 2016 19:09:57 -0700
+Subject: f2fs: remove percpu_count due to performance regression
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+commit 35782b233f37e48ecc469d9c7232f3f6a7fad41a upstream.
+
+This patch removes percpu_count usage due to performance regression in iozone.
+
+Fixes: 523be8a6b3 ("f2fs: use percpu_counter for page counters")
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/f2fs/debug.c | 12 ++++++------
+ fs/f2fs/f2fs.h | 12 ++++++------
+ fs/f2fs/super.c | 16 +++++-----------
+ 3 files changed, 17 insertions(+), 23 deletions(-)
+
+--- a/fs/f2fs/debug.c
++++ b/fs/f2fs/debug.c
+@@ -310,17 +310,17 @@ static int stat_show(struct seq_file *s,
+ seq_printf(s, " - Inner Struct Count: tree: %d(%d), node: %d\n",
+ si->ext_tree, si->zombie_tree, si->ext_node);
+ seq_puts(s, "\nBalancing F2FS Async:\n");
+- seq_printf(s, " - inmem: %4lld, wb_bios: %4d\n",
++ seq_printf(s, " - inmem: %4d, wb_bios: %4d\n",
+ si->inmem_pages, si->wb_bios);
+- seq_printf(s, " - nodes: %4lld in %4d\n",
++ seq_printf(s, " - nodes: %4d in %4d\n",
+ si->ndirty_node, si->node_pages);
+- seq_printf(s, " - dents: %4lld in dirs:%4d (%4d)\n",
++ seq_printf(s, " - dents: %4d in dirs:%4d (%4d)\n",
+ si->ndirty_dent, si->ndirty_dirs, si->ndirty_all);
+- seq_printf(s, " - datas: %4lld in files:%4d\n",
++ seq_printf(s, " - datas: %4d in files:%4d\n",
+ si->ndirty_data, si->ndirty_files);
+- seq_printf(s, " - meta: %4lld in %4d\n",
++ seq_printf(s, " - meta: %4d in %4d\n",
+ si->ndirty_meta, si->meta_pages);
+- seq_printf(s, " - imeta: %4lld\n",
++ seq_printf(s, " - imeta: %4d\n",
+ si->ndirty_imeta);
+ seq_printf(s, " - NATs: %9d/%9d\n - SITs: %9d/%9d\n",
+ si->dirty_nats, si->nats, si->dirty_sits, si->sits);
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -819,7 +819,7 @@ struct f2fs_sb_info {
+ atomic_t nr_wb_bios; /* # of writeback bios */
+
+ /* # of pages, see count_type */
+- struct percpu_counter nr_pages[NR_COUNT_TYPE];
++ atomic_t nr_pages[NR_COUNT_TYPE];
+ /* # of allocated blocks */
+ struct percpu_counter alloc_valid_block_count;
+
+@@ -1233,7 +1233,7 @@ static inline void dec_valid_block_count
+
+ static inline void inc_page_count(struct f2fs_sb_info *sbi, int count_type)
+ {
+- percpu_counter_inc(&sbi->nr_pages[count_type]);
++ atomic_inc(&sbi->nr_pages[count_type]);
+
+ if (count_type == F2FS_DIRTY_DATA || count_type == F2FS_INMEM_PAGES)
+ return;
+@@ -1250,7 +1250,7 @@ static inline void inode_inc_dirty_pages
+
+ static inline void dec_page_count(struct f2fs_sb_info *sbi, int count_type)
+ {
+- percpu_counter_dec(&sbi->nr_pages[count_type]);
++ atomic_dec(&sbi->nr_pages[count_type]);
+ }
+
+ static inline void inode_dec_dirty_pages(struct inode *inode)
+@@ -1266,7 +1266,7 @@ static inline void inode_dec_dirty_pages
+
+ static inline s64 get_pages(struct f2fs_sb_info *sbi, int count_type)
+ {
+- return percpu_counter_sum_positive(&sbi->nr_pages[count_type]);
++ return atomic_read(&sbi->nr_pages[count_type]);
+ }
+
+ static inline int get_dirty_pages(struct inode *inode)
+@@ -2187,8 +2187,8 @@ struct f2fs_stat_info {
+ unsigned long long hit_largest, hit_cached, hit_rbtree;
+ unsigned long long hit_total, total_ext;
+ int ext_tree, zombie_tree, ext_node;
+- s64 ndirty_node, ndirty_dent, ndirty_meta, ndirty_data, ndirty_imeta;
+- s64 inmem_pages;
++ int ndirty_node, ndirty_dent, ndirty_meta, ndirty_data, ndirty_imeta;
++ int inmem_pages;
+ unsigned int ndirty_dirs, ndirty_files, ndirty_all;
+ int nats, dirty_nats, sits, dirty_sits, fnids;
+ int total_count, utilization;
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -688,10 +688,6 @@ static void f2fs_destroy_inode(struct in
+
+ static void destroy_percpu_info(struct f2fs_sb_info *sbi)
+ {
+- int i;
+-
+- for (i = 0; i < NR_COUNT_TYPE; i++)
+- percpu_counter_destroy(&sbi->nr_pages[i]);
+ percpu_counter_destroy(&sbi->alloc_valid_block_count);
+ percpu_counter_destroy(&sbi->total_valid_inode_count);
+ }
+@@ -1442,6 +1438,7 @@ int sanity_check_ckpt(struct f2fs_sb_inf
+ static void init_sb_info(struct f2fs_sb_info *sbi)
+ {
+ struct f2fs_super_block *raw_super = sbi->raw_super;
++ int i;
+
+ sbi->log_sectors_per_block =
+ le32_to_cpu(raw_super->log_sectors_per_block);
+@@ -1466,6 +1463,9 @@ static void init_sb_info(struct f2fs_sb_
+ sbi->interval_time[REQ_TIME] = DEF_IDLE_INTERVAL;
+ clear_sbi_flag(sbi, SBI_NEED_FSCK);
+
++ for (i = 0; i < NR_COUNT_TYPE; i++)
++ atomic_set(&sbi->nr_pages[i], 0);
++
+ INIT_LIST_HEAD(&sbi->s_list);
+ mutex_init(&sbi->umount_mutex);
+ mutex_init(&sbi->wio_mutex[NODE]);
+@@ -1481,13 +1481,7 @@ static void init_sb_info(struct f2fs_sb_
+
+ static int init_percpu_info(struct f2fs_sb_info *sbi)
+ {
+- int i, err;
+-
+- for (i = 0; i < NR_COUNT_TYPE; i++) {
+- err = percpu_counter_init(&sbi->nr_pages[i], 0, GFP_KERNEL);
+- if (err)
+- return err;
+- }
++ int err;
+
+ err = percpu_counter_init(&sbi->alloc_valid_block_count, 0, GFP_KERNEL);
+ if (err)
--- /dev/null
+From c0af52437254fda8b0cdbaae5a9b6d9327f1fcd5 Mon Sep 17 00:00:00 2001
+From: "Guilherme G. Piccoli" <gpiccoli@linux.vnet.ibm.com>
+Date: Wed, 14 Dec 2016 16:01:12 -0200
+Subject: genirq/affinity: Fix node generation from cpumask
+
+From: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
+
+commit c0af52437254fda8b0cdbaae5a9b6d9327f1fcd5 upstream.
+
+Commit 34c3d9819fda ("genirq/affinity: Provide smarter irq spreading
+infrastructure") introduced a better IRQ spreading mechanism, taking
+account of the available NUMA nodes in the machine.
+
+Problem is that the algorithm of retrieving the nodemask iterates
+"linearly" based on the number of online nodes - some architectures
+present non-linear node distribution among the nodemask, like PowerPC.
+If this is the case, the algorithm lead to a wrong node count number
+and therefore to a bad/incomplete IRQ affinity distribution.
+
+For example, this problem were found in a machine with 128 CPUs and two
+nodes, namely nodes 0 and 8 (instead of 0 and 1, if it was linearly
+distributed). This led to a wrong affinity distribution which then led to
+a bad mq allocation for nvme driver.
+
+Finally, we take the opportunity to fix a comment regarding the affinity
+distribution when we have _more_ nodes than vectors.
+
+Fixes: 34c3d9819fda ("genirq/affinity: Provide smarter irq spreading infrastructure")
+Reported-by: Gabriel Krisman Bertazi <gabriel@krisman.be>
+Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Gabriel Krisman Bertazi <gabriel@krisman.be>
+Reviewed-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
+Cc: linux-pci@vger.kernel.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: hch@lst.de
+Link: http://lkml.kernel.org/r/1481738472-2671-1-git-send-email-gpiccoli@linux.vnet.ibm.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/irq/affinity.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/kernel/irq/affinity.c
++++ b/kernel/irq/affinity.c
+@@ -37,10 +37,10 @@ static void irq_spread_init_one(struct c
+
+ static int get_nodes_in_cpumask(const struct cpumask *mask, nodemask_t *nodemsk)
+ {
+- int n, nodes;
++ int n, nodes = 0;
+
+ /* Calculate the number of nodes in the supplied affinity mask */
+- for (n = 0, nodes = 0; n < num_online_nodes(); n++) {
++ for_each_online_node(n) {
+ if (cpumask_intersects(mask, cpumask_of_node(n))) {
+ node_set(n, *nodemsk);
+ nodes++;
+@@ -81,7 +81,7 @@ struct cpumask *irq_create_affinity_mask
+ nodes = get_nodes_in_cpumask(affinity, &nodemsk);
+
+ /*
+- * If the number of nodes in the mask is less than or equal the
++ * If the number of nodes in the mask is greater than or equal the
+ * number of vectors we just spread the vectors across the nodes.
+ */
+ if (nvec <= nodes) {
--- /dev/null
+From 4538bfbf2d9f1fc48c07ac0cc0ee58716fe7fe96 Mon Sep 17 00:00:00 2001
+From: Jared Bents <jared.bents@rockwellcollins.com>
+Date: Fri, 18 Nov 2016 22:20:38 -0600
+Subject: hwmon: (amc6821) sign extension temperature
+
+From: Jared Bents <jared.bents@rockwellcollins.com>
+
+commit 4538bfbf2d9f1fc48c07ac0cc0ee58716fe7fe96 upstream.
+
+Converts the unsigned temperature values from the i2c read
+to be sign extended as defined in the datasheet so that
+negative temperatures are properly read.
+
+Fixes: 28e6274d8fa67 ("hwmon: (amc6821) Avoid forward declaration")
+Signed-off-by: Jared Bents <jared.bents@rockwellcollins.com>
+Signed-off-by: Matt Weber <matthew.weber@rockwellcollins.com>
+[groeck: Dropped unnecessary continuation line]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/amc6821.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/hwmon/amc6821.c
++++ b/drivers/hwmon/amc6821.c
+@@ -188,8 +188,8 @@ static struct amc6821_data *amc6821_upda
+ !data->valid) {
+
+ for (i = 0; i < TEMP_IDX_LEN; i++)
+- data->temp[i] = i2c_smbus_read_byte_data(client,
+- temp_reg[i]);
++ data->temp[i] = (int8_t)i2c_smbus_read_byte_data(
++ client, temp_reg[i]);
+
+ data->stat1 = i2c_smbus_read_byte_data(client,
+ AMC6821_REG_STAT1);
--- /dev/null
+From e36ce99ee0815d7919a7b589bfb66f3de50b6bc7 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 20 Nov 2016 10:37:39 -0800
+Subject: hwmon: (ds620) Fix overflows seen when writing temperature limits
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit e36ce99ee0815d7919a7b589bfb66f3de50b6bc7 upstream.
+
+Module test reports:
+
+temp1_max: Suspected overflow: [160000 vs. 0]
+temp1_min: Suspected overflow: [160000 vs. 0]
+
+This is seen because the values passed when writing temperature limits
+are unbound.
+
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Fixes: 6099469805c2 ("hwmon: Support for Dallas Semiconductor DS620")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/ds620.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/ds620.c
++++ b/drivers/hwmon/ds620.c
+@@ -166,7 +166,7 @@ static ssize_t set_temp(struct device *d
+ if (res)
+ return res;
+
+- val = (val * 10 / 625) * 8;
++ val = (clamp_val(val, -128000, 128000) * 10 / 625) * 8;
+
+ mutex_lock(&data->update_lock);
+ data->temp[attr->index] = val;
--- /dev/null
+From 4fccd4a1e8944033bcd7693ea4e8fb478cd2059a Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 11 Dec 2016 13:27:42 -0800
+Subject: hwmon: (g762) Fix overflows and crash seen when writing limit attributes
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 4fccd4a1e8944033bcd7693ea4e8fb478cd2059a upstream.
+
+Fix overflows seen when writing into fan speed limit attributes.
+Also fix crash due to division by zero, seen when certain very
+large values (such as 2147483648, or 0x80000000) are written
+into fan speed limit attributes.
+
+Fixes: 594fbe713bf60 ("Add support for GMT G762/G763 PWM fan controllers")
+Cc: Arnaud Ebalard <arno@natisbad.org>
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/g762.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwmon/g762.c
++++ b/drivers/hwmon/g762.c
+@@ -193,14 +193,17 @@ static inline unsigned int rpm_from_cnt(
+ * Convert fan RPM value from sysfs into count value for fan controller
+ * register (FAN_SET_CNT).
+ */
+-static inline unsigned char cnt_from_rpm(u32 rpm, u32 clk_freq, u16 p,
++static inline unsigned char cnt_from_rpm(unsigned long rpm, u32 clk_freq, u16 p,
+ u8 clk_div, u8 gear_mult)
+ {
+- if (!rpm) /* to stop the fan, set cnt to 255 */
++ unsigned long f1 = clk_freq * 30 * gear_mult;
++ unsigned long f2 = p * clk_div;
++
++ if (!rpm) /* to stop the fan, set cnt to 255 */
+ return 0xff;
+
+- return clamp_val(((clk_freq * 30 * gear_mult) / (rpm * p * clk_div)),
+- 0, 255);
++ rpm = clamp_val(rpm, f1 / (255 * f2), ULONG_MAX / f2);
++ return DIV_ROUND_CLOSEST(f1, rpm * f2);
+ }
+
+ /* helper to grab and cache data, at most one time per second */
--- /dev/null
+From e9572fdd13e299cfba03abbfd2786c84ac055249 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Mon, 2 Jan 2017 17:53:39 +0100
+Subject: hwmon: (lm90) fix temp1_max_alarm attribute
+
+From: Michael Walle <michael@walle.cc>
+
+commit e9572fdd13e299cfba03abbfd2786c84ac055249 upstream.
+
+Since commit commit eb1c8f4325d5 ("hwmon: (lm90) Convert to use new hwmon
+registration API") the temp1_max_alarm and temp1_crit_alarm attributes are
+mapped to the same alarm bit. Fix the typo.
+
+Fixes: eb1c8f4325d5 ("hwmon: (lm90) Convert to use new hwmon registration API")
+Signed-off-by: Micehael Walle <michael@walle.cc>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/lm90.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/lm90.c
++++ b/drivers/hwmon/lm90.c
+@@ -1036,7 +1036,7 @@ static const u8 lm90_temp_emerg_index[3]
+ };
+
+ static const u8 lm90_min_alarm_bits[3] = { 5, 3, 11 };
+-static const u8 lm90_max_alarm_bits[3] = { 0, 4, 12 };
++static const u8 lm90_max_alarm_bits[3] = { 6, 4, 12 };
+ static const u8 lm90_crit_alarm_bits[3] = { 0, 1, 9 };
+ static const u8 lm90_emergency_alarm_bits[3] = { 15, 13, 14 };
+ static const u8 lm90_fault_bits[3] = { 0, 2, 10 };
--- /dev/null
+From c0d04e9112ad59d73f23f3b0f6726c5e798dfcbf Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Sun, 4 Dec 2016 18:15:25 -0800
+Subject: hwmon: (nct7802) Fix overflows seen when writing into limit attributes
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit c0d04e9112ad59d73f23f3b0f6726c5e798dfcbf upstream.
+
+Fix overflows seen when writing voltage and temperature limit attributes.
+
+The value passed to DIV_ROUND_CLOSEST() needs to be clamped, and the
+value parameter passed to nct7802_write_fan_min() is an unsigned long.
+
+Also, writing values larger than 2700000 into a fan limit attribute results
+in writing 0 into the chip's limit registers. The exact behavior when
+writing this value is unspecified. For consistency, report a limit of
+1350000 if the chip register reads 0. This may be wrong, and the chip
+behavior should be verified with the actual chip, but it is better than
+reporting a value of 0 (which, when written, results in writing a value
+of 0x1fff into the chip register).
+
+Fixes: 3434f3783580 ("hwmon: Driver for Nuvoton NCT7802Y")
+Reviewed-by: Jean Delvare <jdelvare@suse.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/nct7802.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -259,13 +259,15 @@ static int nct7802_read_fan_min(struct n
+ ret = 0;
+ else if (ret)
+ ret = DIV_ROUND_CLOSEST(1350000U, ret);
++ else
++ ret = 1350000U;
+ abort:
+ mutex_unlock(&data->access_lock);
+ return ret;
+ }
+
+ static int nct7802_write_fan_min(struct nct7802_data *data, u8 reg_fan_low,
+- u8 reg_fan_high, unsigned int limit)
++ u8 reg_fan_high, unsigned long limit)
+ {
+ int err;
+
+@@ -326,8 +328,8 @@ static int nct7802_write_voltage(struct
+ int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr];
+ int err;
+
++ voltage = clamp_val(voltage, 0, 0x3ff * nct7802_vmul[nr]);
+ voltage = DIV_ROUND_CLOSEST(voltage, nct7802_vmul[nr]);
+- voltage = clamp_val(voltage, 0, 0x3ff);
+
+ mutex_lock(&data->access_lock);
+ err = regmap_write(data->regmap,
+@@ -402,7 +404,7 @@ static ssize_t store_temp(struct device
+ if (err < 0)
+ return err;
+
+- val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), -128, 127);
++ val = DIV_ROUND_CLOSEST(clamp_val(val, -128000, 127000), 1000);
+
+ err = regmap_write(data->regmap, nr, val & 0xff);
+ return err ? : count;
--- /dev/null
+From 13edb767aa609b6efb7c0c2b57fbd72a6ded0eed Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Mon, 7 Nov 2016 17:31:44 -0300
+Subject: hwmon: (scpi) Fix module autoload
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+commit 13edb767aa609b6efb7c0c2b57fbd72a6ded0eed upstream.
+
+If the driver is built as a module, autoload won't work because the module
+alias information is not filled. So user-space can't match the registered
+device with the corresponding module.
+
+Export the module alias information using the MODULE_DEVICE_TABLE() macro.
+
+Before this patch:
+
+$ modinfo drivers/hwmon/scpi-hwmon.ko | grep alias
+$
+
+After this patch:
+
+$ modinfo drivers/hwmon/scpi-hwmon.ko | grep alias
+alias: of:N*T*Carm,scpi-sensorsC*
+alias: of:N*T*Carm,scpi-sensors
+
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Fixes: ea98b29a05e9c ("hwmon: Support sensors exported via ARM SCP interface")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/scpi-hwmon.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hwmon/scpi-hwmon.c
++++ b/drivers/hwmon/scpi-hwmon.c
+@@ -251,6 +251,7 @@ static const struct of_device_id scpi_of
+ {.compatible = "arm,scpi-sensors"},
+ {},
+ };
++MODULE_DEVICE_TABLE(of, scpi_of_match);
+
+ static struct platform_driver scpi_hwmon_platdrv = {
+ .driver = {
--- /dev/null
+From 9a11a18902bc3b904353063763d06480620245a6 Mon Sep 17 00:00:00 2001
+From: Eric Richter <erichte@linux.vnet.ibm.com>
+Date: Thu, 13 Oct 2016 17:47:36 -0500
+Subject: ima: fix memory leak in ima_release_policy
+
+From: Eric Richter <erichte@linux.vnet.ibm.com>
+
+commit 9a11a18902bc3b904353063763d06480620245a6 upstream.
+
+When the "policy" securityfs file is opened for read, it is opened as a
+sequential file. However, when it is eventually released, there is no
+cleanup for the sequential file, therefore some memory is leaked.
+
+This patch adds a call to seq_release() in ima_release_policy() to clean up
+the memory when the file is opened for read.
+
+Fixes: 80eae209d63a IMA: allow reading back the current policy
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Eric Richter <erichte@linux.vnet.ibm.com>
+Tested-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/integrity/ima/ima_fs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/integrity/ima/ima_fs.c
++++ b/security/integrity/ima/ima_fs.c
+@@ -401,7 +401,7 @@ static int ima_release_policy(struct ino
+ const char *cause = valid_policy ? "completed" : "failed";
+
+ if ((file->f_flags & O_ACCMODE) == O_RDONLY)
+- return 0;
++ return seq_release(inode, file);
+
+ if (valid_policy && ima_check_policy() < 0) {
+ cause = "failed";
--- /dev/null
+From 792f497b22afd0563b94dd8fa129a05f762a2c25 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 16 Nov 2016 17:23:22 -0800
+Subject: Input: synaptics-rmi4 - unlock on error
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 792f497b22afd0563b94dd8fa129a05f762a2c25 upstream.
+
+We should unlock before returning on this error path.
+
+Fixes: 3a762dbd5347 ('[media] Input: synaptics-rmi4 - add support for F54 diagnostics')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/rmi4/rmi_f54.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/input/rmi4/rmi_f54.c
++++ b/drivers/input/rmi4/rmi_f54.c
+@@ -200,7 +200,7 @@ static int rmi_f54_request_report(struct
+
+ error = rmi_write(rmi_dev, fn->fd.command_base_addr, F54_GET_REPORT);
+ if (error < 0)
+- return error;
++ goto unlock;
+
+ init_completion(&f54->cmd_done);
+
+@@ -209,9 +209,10 @@ static int rmi_f54_request_report(struct
+
+ queue_delayed_work(f54->workqueue, &f54->work, 0);
+
++unlock:
+ mutex_unlock(&f54->data_mutex);
+
+- return 0;
++ return error;
+ }
+
+ static size_t rmi_f54_get_report_size(struct f54_data *f54)
--- /dev/null
+From 432abf68a79332282329286d190e21fe3ac02a31 Mon Sep 17 00:00:00 2001
+From: Huang Rui <ray.huang@amd.com>
+Date: Mon, 12 Dec 2016 07:28:26 -0500
+Subject: iommu/amd: Fix the left value check of cmd buffer
+
+From: Huang Rui <ray.huang@amd.com>
+
+commit 432abf68a79332282329286d190e21fe3ac02a31 upstream.
+
+The generic command buffer entry is 128 bits (16 bytes), so the offset
+of tail and head pointer should be 16 bytes aligned and increased with
+0x10 per command.
+
+When cmd buf is full, head = (tail + 0x10) % CMD_BUFFER_SIZE.
+
+So when left space of cmd buf should be able to store only two
+command, we should be issued one COMPLETE_WAIT additionally to wait
+all older commands completed. Then the left space should be increased
+after IOMMU fetching from cmd buf.
+
+So left check value should be left <= 0x20 (two commands).
+
+Signed-off-by: Huang Rui <ray.huang@amd.com>
+Fixes: ac0ea6e92b222 ('x86/amd-iommu: Improve handling of full command buffer')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1021,7 +1021,7 @@ again:
+ next_tail = (tail + sizeof(*cmd)) % CMD_BUFFER_SIZE;
+ left = (head - next_tail) % CMD_BUFFER_SIZE;
+
+- if (left <= 2) {
++ if (left <= 0x20) {
+ struct iommu_cmd sync_cmd;
+ int ret;
+
--- /dev/null
+From 24c790fbf5d8f54c8c82979db11edea8855b74bf Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 24 Nov 2016 14:05:44 +0300
+Subject: iommu/amd: Missing error code in amd_iommu_init_device()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 24c790fbf5d8f54c8c82979db11edea8855b74bf upstream.
+
+We should set "ret" to -EINVAL if iommu_group_get() fails.
+
+Fixes: 55c99a4dc50f ("iommu/amd: Use iommu_attach_group()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/amd_iommu_v2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/amd_iommu_v2.c
++++ b/drivers/iommu/amd_iommu_v2.c
+@@ -805,8 +805,10 @@ int amd_iommu_init_device(struct pci_dev
+ goto out_free_domain;
+
+ group = iommu_group_get(&pdev->dev);
+- if (!group)
++ if (!group) {
++ ret = -EINVAL;
+ goto out_free_domain;
++ }
+
+ ret = iommu_attach_group(dev_state->domain, group);
+ if (ret != 0)
--- /dev/null
+From 65ca7f5f7d1cdde6c25172fe6107cd16902f826f Mon Sep 17 00:00:00 2001
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Date: Tue, 6 Dec 2016 10:14:23 -0800
+Subject: iommu/vt-d: Fix pasid table size encoding
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+commit 65ca7f5f7d1cdde6c25172fe6107cd16902f826f upstream.
+
+Different encodings are used to represent supported PASID bits
+and number of PASID table entries.
+The current code assigns ecap_pss directly to extended context
+table entry PTS which is wrong and could result in writing
+non-zero bits to the reserved fields. IOMMU fault reason
+11 will be reported when reserved bits are nonzero.
+This patch converts ecap_pss to extend context entry pts encoding
+based on VT-d spec. Chapter 9.4 as follows:
+ - number of PASID bits = ecap_pss + 1
+ - number of PASID table entries = 2^(pts + 5)
+Software assigned limit of pasid_max value is also respected to
+match the allocation limitation of PASID table.
+
+cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+cc: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Tested-by: Mika Kuoppala <mika.kuoppala@intel.com>
+Fixes: 2f26e0a9c9860 ('iommu/vt-d: Add basic SVM PASID support')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -5197,6 +5197,25 @@ static void intel_iommu_remove_device(st
+ }
+
+ #ifdef CONFIG_INTEL_IOMMU_SVM
++#define MAX_NR_PASID_BITS (20)
++static inline unsigned long intel_iommu_get_pts(struct intel_iommu *iommu)
++{
++ /*
++ * Convert ecap_pss to extend context entry pts encoding, also
++ * respect the soft pasid_max value set by the iommu.
++ * - number of PASID bits = ecap_pss + 1
++ * - number of PASID table entries = 2^(pts + 5)
++ * Therefore, pts = ecap_pss - 4
++ * e.g. KBL ecap_pss = 0x13, PASID has 20 bits, pts = 15
++ */
++ if (ecap_pss(iommu->ecap) < 5)
++ return 0;
++
++ /* pasid_max is encoded as actual number of entries not the bits */
++ return find_first_bit((unsigned long *)&iommu->pasid_max,
++ MAX_NR_PASID_BITS) - 5;
++}
++
+ int intel_iommu_enable_pasid(struct intel_iommu *iommu, struct intel_svm_dev *sdev)
+ {
+ struct device_domain_info *info;
+@@ -5229,7 +5248,9 @@ int intel_iommu_enable_pasid(struct inte
+
+ if (!(ctx_lo & CONTEXT_PASIDE)) {
+ context[1].hi = (u64)virt_to_phys(iommu->pasid_state_table);
+- context[1].lo = (u64)virt_to_phys(iommu->pasid_table) | ecap_pss(iommu->ecap);
++ context[1].lo = (u64)virt_to_phys(iommu->pasid_table) |
++ intel_iommu_get_pts(iommu);
++
+ wmb();
+ /* CONTEXT_TT_MULTI_LEVEL and CONTEXT_TT_DEV_IOTLB are both
+ * extended to permit requests-with-PASID if the PASIDE bit
--- /dev/null
+From aec0e86172a79eb5e44aff1055bb953fe4d47c59 Mon Sep 17 00:00:00 2001
+From: Xunlei Pang <xlpang@redhat.com>
+Date: Mon, 5 Dec 2016 20:09:07 +0800
+Subject: iommu/vt-d: Flush old iommu caches for kdump when the device gets context mapped
+
+From: Xunlei Pang <xlpang@redhat.com>
+
+commit aec0e86172a79eb5e44aff1055bb953fe4d47c59 upstream.
+
+We met the DMAR fault both on hpsa P420i and P421 SmartArray controllers
+under kdump, it can be steadily reproduced on several different machines,
+the dmesg log is like:
+HP HPSA Driver (v 3.4.16-0)
+hpsa 0000:02:00.0: using doorbell to reset controller
+hpsa 0000:02:00.0: board ready after hard reset.
+hpsa 0000:02:00.0: Waiting for controller to respond to no-op
+DMAR: Setting identity map for device 0000:02:00.0 [0xe8000 - 0xe8fff]
+DMAR: Setting identity map for device 0000:02:00.0 [0xf4000 - 0xf4fff]
+DMAR: Setting identity map for device 0000:02:00.0 [0xbdf6e000 - 0xbdf6efff]
+DMAR: Setting identity map for device 0000:02:00.0 [0xbdf6f000 - 0xbdf7efff]
+DMAR: Setting identity map for device 0000:02:00.0 [0xbdf7f000 - 0xbdf82fff]
+DMAR: Setting identity map for device 0000:02:00.0 [0xbdf83000 - 0xbdf84fff]
+DMAR: DRHD: handling fault status reg 2
+DMAR: [DMA Read] Request device [02:00.0] fault addr fffff000 [fault reason 06] PTE Read access is not set
+hpsa 0000:02:00.0: controller message 03:00 timed out
+hpsa 0000:02:00.0: no-op failed; re-trying
+
+After some debugging, we found that the fault addr is from DMA initiated at
+the driver probe stage after reset(not in-flight DMA), and the corresponding
+pte entry value is correct, the fault is likely due to the old iommu caches
+of the in-flight DMA before it.
+
+Thus we need to flush the old cache after context mapping is setup for the
+device, where the device is supposed to finish reset at its driver probe
+stage and no in-flight DMA exists hereafter.
+
+I'm not sure if the hardware is responsible for invalidating all the related
+caches allocated in the iommu hardware before, but seems not the case for hpsa,
+actually many device drivers have problems in properly resetting the hardware.
+Anyway flushing (again) by software in kdump kernel when the device gets context
+mapped which is a quite infrequent operation does little harm.
+
+With this patch, the problematic machine can survive the kdump tests.
+
+CC: Myron Stowe <myron.stowe@gmail.com>
+CC: Joseph Szczypek <jszczype@redhat.com>
+CC: Don Brace <don.brace@microsemi.com>
+CC: Baoquan He <bhe@redhat.com>
+CC: Dave Young <dyoung@redhat.com>
+Fixes: 091d42e43d21 ("iommu/vt-d: Copy translation tables from old kernel")
+Fixes: dbcd861f252d ("iommu/vt-d: Do not re-use domain-ids from the old kernel")
+Fixes: cf484d0e6939 ("iommu/vt-d: Mark copied context entries")
+Signed-off-by: Xunlei Pang <xlpang@redhat.com>
+Tested-by: Don Brace <don.brace@microsemi.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2037,6 +2037,25 @@ static int domain_context_mapping_one(st
+ if (context_present(context))
+ goto out_unlock;
+
++ /*
++ * For kdump cases, old valid entries may be cached due to the
++ * in-flight DMA and copied pgtable, but there is no unmapping
++ * behaviour for them, thus we need an explicit cache flush for
++ * the newly-mapped device. For kdump, at this point, the device
++ * is supposed to finish reset at its driver probe stage, so no
++ * in-flight DMA will exist, and we don't need to worry anymore
++ * hereafter.
++ */
++ if (context_copied(context)) {
++ u16 did_old = context_domain_id(context);
++
++ if (did_old >= 0 && did_old < cap_ndoms(iommu->cap))
++ iommu->flush.flush_context(iommu, did_old,
++ (((u16)bus) << 8) | devfn,
++ DMA_CCMD_MASK_NOBIT,
++ DMA_CCMD_DEVICE_INVL);
++ }
++
+ pgd = domain->pgd;
+
+ context_clear_entry(context);
--- /dev/null
+From 34c535793bcbf9263cf22f8a52101f796cdfab8e Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 31 Oct 2016 14:17:35 -0700
+Subject: irqchip/bcm7038-l1: Implement irq_cpu_offline() callback
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit 34c535793bcbf9263cf22f8a52101f796cdfab8e upstream.
+
+We did not implement an irq_cpu_offline callback for our irqchip, yet we
+support setting a given IRQ's affinity. This resulted in interrupts
+whose affinity mask included CPUs being taken offline not to work
+correctly once the CPU had been put offline.
+
+Fixes: 5f7f0317ed28 ("IRQCHIP: Add new driver for BCM7038-style level 1 interrupt controllers")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: jason@lakedaemon.net
+Cc: marc.zyngier@arm.com
+Cc: cernekee@gmail.com
+Cc: jaedon.shin@gmail.com
+Cc: ralf@linux-mips.org
+Cc: justinpopo6@gmail.com
+Link: http://lkml.kernel.org/r/1477948656-12966-2-git-send-email-f.fainelli@gmail.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/irqchip/irq-bcm7038-l1.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+--- a/drivers/irqchip/irq-bcm7038-l1.c
++++ b/drivers/irqchip/irq-bcm7038-l1.c
+@@ -215,6 +215,31 @@ static int bcm7038_l1_set_affinity(struc
+ return 0;
+ }
+
++static void bcm7038_l1_cpu_offline(struct irq_data *d)
++{
++ struct cpumask *mask = irq_data_get_affinity_mask(d);
++ int cpu = smp_processor_id();
++ cpumask_t new_affinity;
++
++ /* This CPU was not on the affinity mask */
++ if (!cpumask_test_cpu(cpu, mask))
++ return;
++
++ if (cpumask_weight(mask) > 1) {
++ /*
++ * Multiple CPU affinity, remove this CPU from the affinity
++ * mask
++ */
++ cpumask_copy(&new_affinity, mask);
++ cpumask_clear_cpu(cpu, &new_affinity);
++ } else {
++ /* Only CPU, put on the lowest online CPU */
++ cpumask_clear(&new_affinity);
++ cpumask_set_cpu(cpumask_first(cpu_online_mask), &new_affinity);
++ }
++ irq_set_affinity_locked(d, &new_affinity, false);
++}
++
+ static int __init bcm7038_l1_init_one(struct device_node *dn,
+ unsigned int idx,
+ struct bcm7038_l1_chip *intc)
+@@ -266,6 +291,7 @@ static struct irq_chip bcm7038_l1_irq_ch
+ .irq_mask = bcm7038_l1_mask,
+ .irq_unmask = bcm7038_l1_unmask,
+ .irq_set_affinity = bcm7038_l1_set_affinity,
++ .irq_cpu_offline = bcm7038_l1_cpu_offline,
+ };
+
+ static int bcm7038_l1_map(struct irq_domain *d, unsigned int virq,
--- /dev/null
+From e2342ca832726a840ca6bd196dd2cc073815b08a Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.com>
+Date: Mon, 5 Dec 2016 16:40:50 +1100
+Subject: md: fix refcount problem on mddev when stopping array.
+
+From: NeilBrown <neilb@suse.com>
+
+commit e2342ca832726a840ca6bd196dd2cc073815b08a upstream.
+
+md_open() gets a counted reference on an mddev using mddev_find().
+If it ends up returning an error, it must drop this reference.
+
+There are two error paths where the reference is not dropped.
+One only happens if the process is signalled and an awkward time,
+which is quite unlikely.
+The other was introduced recently in commit af8d8e6f0.
+
+Change the code to ensure the drop the reference when returning an error,
+and make it harded to re-introduce this sort of bug in the future.
+
+Reported-by: Marc Smith <marc.smith@mcc.edu>
+Fixes: af8d8e6f0315 ("md: changes for MD_STILL_CLOSED flag")
+Signed-off-by: NeilBrown <neilb@suse.com>
+Acked-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7092,7 +7092,8 @@ static int md_open(struct block_device *
+
+ if (test_bit(MD_CLOSING, &mddev->flags)) {
+ mutex_unlock(&mddev->open_mutex);
+- return -ENODEV;
++ err = -ENODEV;
++ goto out;
+ }
+
+ err = 0;
+@@ -7101,6 +7102,8 @@ static int md_open(struct block_device *
+
+ check_disk_change(bdev);
+ out:
++ if (err)
++ mddev_put(mddev);
+ return err;
+ }
+
--- /dev/null
+From 82a301cb0ea2df8a5c88213094a01660067c7fb4 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@fb.com>
+Date: Thu, 8 Dec 2016 15:48:18 -0800
+Subject: md: MD_RECOVERY_NEEDED is set for mddev->recovery
+
+From: Shaohua Li <shli@fb.com>
+
+commit 82a301cb0ea2df8a5c88213094a01660067c7fb4 upstream.
+
+Fixes: 90f5f7ad4f38("md: Wait for md_check_recovery before attempting device
+removal.")
+
+Reviewed-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/md.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -6829,7 +6829,7 @@ static int md_ioctl(struct block_device
+ /* need to ensure recovery thread has run */
+ wait_event_interruptible_timeout(mddev->sb_wait,
+ !test_bit(MD_RECOVERY_NEEDED,
+- &mddev->flags),
++ &mddev->recovery),
+ msecs_to_jiffies(5000));
+ if (cmd == STOP_ARRAY || cmd == STOP_ARRAY_RO) {
+ /* Need to flush page cache, and ensure no-one else opens
--- /dev/null
+From 6afcf8ef0ca0a69d014f8edb613d94821f0ae700 Mon Sep 17 00:00:00 2001
+From: Ming Ling <ming.ling@spreadtrum.com>
+Date: Mon, 12 Dec 2016 16:42:26 -0800
+Subject: mm, compaction: fix NR_ISOLATED_* stats for pfn based migration
+
+From: Ming Ling <ming.ling@spreadtrum.com>
+
+commit 6afcf8ef0ca0a69d014f8edb613d94821f0ae700 upstream.
+
+Since commit bda807d44454 ("mm: migrate: support non-lru movable page
+migration") isolate_migratepages_block) can isolate !PageLRU pages which
+would acct_isolated account as NR_ISOLATED_*. Accounting these non-lru
+pages NR_ISOLATED_{ANON,FILE} doesn't make any sense and it can misguide
+heuristics based on those counters such as pgdat_reclaimable_pages resp.
+too_many_isolated which would lead to unexpected stalls during the
+direct reclaim without any good reason. Note that
+__alloc_contig_migrate_range can isolate a lot of pages at once.
+
+On mobile devices such as 512M ram android Phone, it may use a big zram
+swap. In some cases zram(zsmalloc) uses too many non-lru but
+migratedable pages, such as:
+
+ MemTotal: 468148 kB
+ Normal free:5620kB
+ Free swap:4736kB
+ Total swap:409596kB
+ ZRAM: 164616kB(zsmalloc non-lru pages)
+ active_anon:60700kB
+ inactive_anon:60744kB
+ active_file:34420kB
+ inactive_file:37532kB
+
+Fix this by only accounting lru pages to NR_ISOLATED_* in
+isolate_migratepages_block right after they were isolated and we still
+know they were on LRU. Drop acct_isolated because it is called after
+the fact and we've lost that information. Batching per-cpu counter
+doesn't make much improvement anyway. Also make sure that we uncharge
+only LRU pages when putting them back on the LRU in
+putback_movable_pages resp. when unmap_and_move migrates the page.
+
+[mhocko@suse.com: replace acct_isolated() with direct counting]
+Fixes: bda807d44454 ("mm: migrate: support non-lru movable page migration")
+Link: http://lkml.kernel.org/r/20161019080240.9682-1-mhocko@kernel.org
+Signed-off-by: Ming Ling <ming.ling@spreadtrum.com>
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Minchan Kim <minchan@kernel.org>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Joonsoo Kim <js1304@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/compaction.c | 25 +++----------------------
+ mm/migrate.c | 15 +++++++++++----
+ 2 files changed, 14 insertions(+), 26 deletions(-)
+
+--- a/mm/compaction.c
++++ b/mm/compaction.c
+@@ -634,22 +634,6 @@ isolate_freepages_range(struct compact_c
+ return pfn;
+ }
+
+-/* Update the number of anon and file isolated pages in the zone */
+-static void acct_isolated(struct zone *zone, struct compact_control *cc)
+-{
+- struct page *page;
+- unsigned int count[2] = { 0, };
+-
+- if (list_empty(&cc->migratepages))
+- return;
+-
+- list_for_each_entry(page, &cc->migratepages, lru)
+- count[!!page_is_file_cache(page)]++;
+-
+- mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_ANON, count[0]);
+- mod_node_page_state(zone->zone_pgdat, NR_ISOLATED_FILE, count[1]);
+-}
+-
+ /* Similar to reclaim, but different enough that they don't share logic */
+ static bool too_many_isolated(struct zone *zone)
+ {
+@@ -866,6 +850,8 @@ isolate_migratepages_block(struct compac
+
+ /* Successfully isolated */
+ del_page_from_lru_list(page, lruvec, page_lru(page));
++ inc_node_page_state(page,
++ NR_ISOLATED_ANON + page_is_file_cache(page));
+
+ isolate_success:
+ list_add(&page->lru, &cc->migratepages);
+@@ -902,7 +888,6 @@ isolate_fail:
+ spin_unlock_irqrestore(zone_lru_lock(zone), flags);
+ locked = false;
+ }
+- acct_isolated(zone, cc);
+ putback_movable_pages(&cc->migratepages);
+ cc->nr_migratepages = 0;
+ cc->last_migrated_pfn = 0;
+@@ -988,7 +973,6 @@ isolate_migratepages_range(struct compac
+ if (cc->nr_migratepages == COMPACT_CLUSTER_MAX)
+ break;
+ }
+- acct_isolated(cc->zone, cc);
+
+ return pfn;
+ }
+@@ -1258,10 +1242,8 @@ static isolate_migrate_t isolate_migrate
+ low_pfn = isolate_migratepages_block(cc, low_pfn,
+ block_end_pfn, isolate_mode);
+
+- if (!low_pfn || cc->contended) {
+- acct_isolated(zone, cc);
++ if (!low_pfn || cc->contended)
+ return ISOLATE_ABORT;
+- }
+
+ /*
+ * Either we isolated something and proceed with migration. Or
+@@ -1271,7 +1253,6 @@ static isolate_migrate_t isolate_migrate
+ break;
+ }
+
+- acct_isolated(zone, cc);
+ /* Record where migration scanner will be restarted. */
+ cc->migrate_pfn = low_pfn;
+
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -168,8 +168,6 @@ void putback_movable_pages(struct list_h
+ continue;
+ }
+ list_del(&page->lru);
+- dec_node_page_state(page, NR_ISOLATED_ANON +
+- page_is_file_cache(page));
+ /*
+ * We isolated non-lru movable page so here we can use
+ * __PageMovable because LRU page's mapping cannot have
+@@ -186,6 +184,8 @@ void putback_movable_pages(struct list_h
+ put_page(page);
+ } else {
+ putback_lru_page(page);
++ dec_node_page_state(page, NR_ISOLATED_ANON +
++ page_is_file_cache(page));
+ }
+ }
+ }
+@@ -1121,8 +1121,15 @@ out:
+ * restored.
+ */
+ list_del(&page->lru);
+- dec_node_page_state(page, NR_ISOLATED_ANON +
+- page_is_file_cache(page));
++
++ /*
++ * Compaction can migrate also non-LRU pages which are
++ * not accounted to NR_ISOLATED_*. They can be recognized
++ * as __PageMovable
++ */
++ if (likely(!__PageMovable(page)))
++ dec_node_page_state(page, NR_ISOLATED_ANON +
++ page_is_file_cache(page));
+ }
+
+ /*
--- /dev/null
+From 3999f52e3198e76607446ab1a4610c1ddc406c56 Mon Sep 17 00:00:00 2001
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+Date: Mon, 12 Dec 2016 16:41:56 -0800
+Subject: mm/hugetlb.c: use the right pte val for compare in hugetlb_cow
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+
+commit 3999f52e3198e76607446ab1a4610c1ddc406c56 upstream.
+
+We cannot use the pte value used in set_pte_at for pte_same comparison,
+because archs like ppc64, filter/add new pte flag in set_pte_at.
+Instead fetch the pte value inside hugetlb_cow. We are comparing pte
+value to make sure the pte didn't change since we dropped the page table
+lock. hugetlb_cow get called with page table lock held, and we can take
+a copy of the pte value before we drop the page table lock.
+
+With hugetlbfs, we optimize the MAP_PRIVATE write fault path with no
+previous mapping (huge_pte_none entries), by forcing a cow in the fault
+path. This avoid take an addition fault to covert a read-only mapping
+to read/write. Here we were comparing a recently instantiated pte (via
+set_pte_at) to the pte values from linux page table. As explained above
+on ppc64 such pte_same check returned wrong result, resulting in us
+taking an additional fault on ppc64.
+
+Fixes: 6a119eae942c ("powerpc/mm: Add a _PAGE_PTE bit")
+Link: http://lkml.kernel.org/r/20161018154245.18023-1-aneesh.kumar@linux.vnet.ibm.com
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Reported-by: Jan Stancek <jstancek@redhat.com>
+Acked-by: Hillf Danton <hillf.zj@alibaba-inc.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Scott Wood <scottwood@freescale.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/hugetlb.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -3450,15 +3450,17 @@ static void unmap_ref_private(struct mm_
+ * Keep the pte_same checks anyway to make transition from the mutex easier.
+ */
+ static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
+- unsigned long address, pte_t *ptep, pte_t pte,
+- struct page *pagecache_page, spinlock_t *ptl)
++ unsigned long address, pte_t *ptep,
++ struct page *pagecache_page, spinlock_t *ptl)
+ {
++ pte_t pte;
+ struct hstate *h = hstate_vma(vma);
+ struct page *old_page, *new_page;
+ int ret = 0, outside_reserve = 0;
+ unsigned long mmun_start; /* For mmu_notifiers */
+ unsigned long mmun_end; /* For mmu_notifiers */
+
++ pte = huge_ptep_get(ptep);
+ old_page = pte_page(pte);
+
+ retry_avoidcopy:
+@@ -3733,7 +3735,7 @@ retry:
+ hugetlb_count_add(pages_per_huge_page(h), mm);
+ if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
+ /* Optimization, do the COW without a second fault */
+- ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page, ptl);
++ ret = hugetlb_cow(mm, vma, address, ptep, page, ptl);
+ }
+
+ spin_unlock(ptl);
+@@ -3888,8 +3890,8 @@ int hugetlb_fault(struct mm_struct *mm,
+
+ if (flags & FAULT_FLAG_WRITE) {
+ if (!huge_pte_write(entry)) {
+- ret = hugetlb_cow(mm, vma, address, ptep, entry,
+- pagecache_page, ptl);
++ ret = hugetlb_cow(mm, vma, address, ptep,
++ pagecache_page, ptl);
+ goto out_put_page;
+ }
+ entry = huge_pte_mkdirty(entry);
--- /dev/null
+From 91a45f71078a6569ec3ca5bef74e1ab58121d80e Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Mon, 12 Dec 2016 16:43:32 -0800
+Subject: mm: khugepaged: close use-after-free race during shmem collapsing
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit 91a45f71078a6569ec3ca5bef74e1ab58121d80e upstream.
+
+Patch series "mm: workingset: radix tree subtleties & single-page file
+refaults", v3.
+
+This is another revision of the radix tree / workingset patches based on
+feedback from Jan and Kirill.
+
+This is a follow-up to d3798ae8c6f3 ("mm: filemap: don't plant shadow
+entries without radix tree node"). That patch fixed an issue that was
+caused mainly by the page cache sneaking special shadow page entries
+into the radix tree and relying on subtleties in the radix tree code to
+make that work. The fix also had to stop tracking refaults for
+single-page files because shadow pages stored as direct pointers in
+radix_tree_root->rnode weren't properly handled during tree extension.
+
+These patches make the radix tree code explicitely support and track
+such special entries, to eliminate the subtleties and to restore the
+thrash detection for single-page files.
+
+This patch (of 9):
+
+When a radix tree iteration drops the tree lock, another thread might
+swoop in and free the node holding the current slot. The iteration
+needs to do another tree lookup from the current index to continue.
+
+[kirill.shutemov@linux.intel.com: re-lookup for replacement]
+Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages")
+Link: http://lkml.kernel.org/r/20161117191138.22769-2-hannes@cmpxchg.org
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Matthew Wilcox <mawilcox@linuxonhyperv.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/khugepaged.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1403,6 +1403,9 @@ static void collapse_shmem(struct mm_str
+
+ spin_lock_irq(&mapping->tree_lock);
+
++ slot = radix_tree_lookup_slot(&mapping->page_tree, index);
++ VM_BUG_ON_PAGE(page != radix_tree_deref_slot_protected(slot,
++ &mapping->tree_lock), page);
+ VM_BUG_ON_PAGE(page_mapped(page), page);
+
+ /*
+@@ -1426,6 +1429,7 @@ static void collapse_shmem(struct mm_str
+ radix_tree_replace_slot(slot,
+ new_page + (index % HPAGE_PMD_NR));
+
++ slot = radix_tree_iter_next(&iter);
+ index++;
+ continue;
+ out_lru:
+@@ -1537,6 +1541,7 @@ tree_unlocked:
+ putback_lru_page(page);
+ unlock_page(page);
+ spin_lock_irq(&mapping->tree_lock);
++ slot = radix_tree_iter_next(&iter);
+ }
+ VM_BUG_ON(nr_none);
+ spin_unlock_irq(&mapping->tree_lock);
--- /dev/null
+From 59749e6ce53735d8b696763742225f126e94603f Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Mon, 12 Dec 2016 16:43:35 -0800
+Subject: mm: khugepaged: fix radix tree node leak in shmem collapse error path
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit 59749e6ce53735d8b696763742225f126e94603f upstream.
+
+The radix tree counts valid entries in each tree node. Entries stored
+in the tree cannot be removed by simpling storing NULL in the slot or
+the internal counters will be off and the node never gets freed again.
+
+When collapsing a shmem page fails, restore the holes that were filled
+with radix_tree_insert() with a proper radix tree deletion.
+
+Fixes: f3f0e1d2150b ("khugepaged: add support of collapse for tmpfs/shmem pages")
+Link: http://lkml.kernel.org/r/20161117191138.22769-3-hannes@cmpxchg.org
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Reported-by: Jan Kara <jack@suse.cz>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Matthew Wilcox <mawilcox@linuxonhyperv.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/khugepaged.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1525,9 +1525,11 @@ tree_unlocked:
+ if (!page || iter.index < page->index) {
+ if (!nr_none)
+ break;
+- /* Put holes back where they were */
+- radix_tree_replace_slot(slot, NULL);
+ nr_none--;
++ /* Put holes back where they were */
++ radix_tree_delete(&mapping->page_tree,
++ iter.index);
++ slot = radix_tree_iter_next(&iter);
+ continue;
+ }
+
--- /dev/null
+From 16652a936e96f5dae53c3fbd38a570497baadaa8 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 14 Nov 2016 14:31:34 +0300
+Subject: mmc: mmc_test: Uninitialized return value
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 16652a936e96f5dae53c3fbd38a570497baadaa8 upstream.
+
+We never set "ret" to RESULT_OK.
+
+Fixes: 9f9c4180f88d ("mmc: mmc_test: add test for non-blocking transfers")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/card/mmc_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/card/mmc_test.c
++++ b/drivers/mmc/card/mmc_test.c
+@@ -818,7 +818,7 @@ static int mmc_test_nonblock_transfer(st
+ struct mmc_async_req *cur_areq = &test_areq[0].areq;
+ struct mmc_async_req *other_areq = &test_areq[1].areq;
+ int i;
+- int ret;
++ int ret = RESULT_OK;
+
+ test_areq[0].test = test;
+ test_areq[1].test = test;
--- /dev/null
+From 7254383341bc6e1a61996accd836009f0c922b21 Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Thu, 17 Nov 2016 16:06:56 -0600
+Subject: PCI: Add Mellanox device IDs
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 7254383341bc6e1a61996accd836009f0c922b21 upstream.
+
+Add Mellanox device IDs for use by the mlx4 driver and INTx quirks.
+
+[bhelgaas: sorted and adapted from
+http://lkml.kernel.org/r/1478011644-12080-1-git-send-email-noaos@mellanox.com]
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/pci_ids.h | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -2256,12 +2256,29 @@
+ #define PCI_DEVICE_ID_ZOLTRIX_2BD0 0x2bd0
+
+ #define PCI_VENDOR_ID_MELLANOX 0x15b3
+-#define PCI_DEVICE_ID_MELLANOX_TAVOR 0x5a44
++#define PCI_DEVICE_ID_MELLANOX_CONNECTX3 0x1003
++#define PCI_DEVICE_ID_MELLANOX_CONNECTX3_PRO 0x1007
++#define PCI_DEVICE_ID_MELLANOX_CONNECTIB 0x1011
++#define PCI_DEVICE_ID_MELLANOX_CONNECTX4 0x1013
++#define PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX 0x1015
++#define PCI_DEVICE_ID_MELLANOX_TAVOR 0x5a44
+ #define PCI_DEVICE_ID_MELLANOX_TAVOR_BRIDGE 0x5a46
+-#define PCI_DEVICE_ID_MELLANOX_ARBEL_COMPAT 0x6278
+-#define PCI_DEVICE_ID_MELLANOX_ARBEL 0x6282
+-#define PCI_DEVICE_ID_MELLANOX_SINAI_OLD 0x5e8c
+-#define PCI_DEVICE_ID_MELLANOX_SINAI 0x6274
++#define PCI_DEVICE_ID_MELLANOX_SINAI_OLD 0x5e8c
++#define PCI_DEVICE_ID_MELLANOX_SINAI 0x6274
++#define PCI_DEVICE_ID_MELLANOX_ARBEL_COMPAT 0x6278
++#define PCI_DEVICE_ID_MELLANOX_ARBEL 0x6282
++#define PCI_DEVICE_ID_MELLANOX_HERMON_SDR 0x6340
++#define PCI_DEVICE_ID_MELLANOX_HERMON_DDR 0x634a
++#define PCI_DEVICE_ID_MELLANOX_HERMON_QDR 0x6354
++#define PCI_DEVICE_ID_MELLANOX_HERMON_EN 0x6368
++#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN 0x6372
++#define PCI_DEVICE_ID_MELLANOX_HERMON_DDR_GEN2 0x6732
++#define PCI_DEVICE_ID_MELLANOX_HERMON_QDR_GEN2 0x673c
++#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_5_GEN2 0x6746
++#define PCI_DEVICE_ID_MELLANOX_HERMON_EN_GEN2 0x6750
++#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_T_GEN2 0x675a
++#define PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_GEN2 0x6764
++#define PCI_DEVICE_ID_MELLANOX_CONNECTX2 0x676e
+
+ #define PCI_VENDOR_ID_DFI 0x15bd
+
--- /dev/null
+From b88214ce4d7064992452765028bd50702414f15f Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Tue, 15 Nov 2016 09:59:58 +0200
+Subject: PCI: Convert broken INTx masking quirks from HEADER to FINAL
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit b88214ce4d7064992452765028bd50702414f15f upstream.
+
+Convert all quirk_broken_intx_masking() quirks from HEADER to FINAL.
+
+The quirk sets dev->broken_intx_masking, which is only used by
+pci_intx_mask_supported(), which is not needed until after FINAL
+quirks have been run.
+
+[bhelgaas: changelog]
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/quirks.c | 72 +++++++++++++++++++++++++--------------------------
+ 1 file changed, 36 insertions(+), 36 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3146,53 +3146,53 @@ static void quirk_broken_intx_masking(st
+ {
+ dev->broken_intx_masking = 1;
+ }
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_CHELSIO, 0x0030,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */
+- quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x0030,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */
++ quirk_broken_intx_masking);
+ /*
+ * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10)
+ * Subsystem: Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC
+ *
+ * RTL8110SC - Fails under PCI device assignment using DisINTx masking.
+ */
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_REALTEK, 0x8169,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
+- quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_REALTEK, 0x8169,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
++ quirk_broken_intx_masking);
+
+ /*
+ * Intel i40e (XL710/X710) 10/20/40GbE NICs all have broken INTx masking,
+ * DisINTx can be set but the interrupt status bit is non-functional.
+ */
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1572,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1574,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1580,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1581,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1583,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1584,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1585,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1586,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1587,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1588,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x1589,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x37d0,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x37d1,
+- quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x37d2,
+- quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1572,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1574,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1580,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1581,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1583,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1584,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1585,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1586,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1587,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1588,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1589,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d0,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d1,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d2,
++ quirk_broken_intx_masking);
+
+ static void quirk_no_bus_reset(struct pci_dev *dev)
+ {
--- /dev/null
+From d76d2fe05fd93673d184af77255bbbc63780f4ea Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Tue, 15 Nov 2016 09:59:59 +0200
+Subject: PCI: Convert Mellanox broken INTx quirks to be for listed devices only
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit d76d2fe05fd93673d184af77255bbbc63780f4ea upstream.
+
+Change Mellanox's broken_intx_masking() quirk from an "all Mellanox
+devices" to a quirk for listed devices only.
+
+[bhelgaas: remove #defines, reorder to keep other quirks together]
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
+Reviewed-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/quirks.c | 40 +++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 37 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3137,8 +3137,9 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x22b7, quirk_remove_d3_delay);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x2298, quirk_remove_d3_delay);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x229c, quirk_remove_d3_delay);
++
+ /*
+- * Some devices may pass our check in pci_intx_mask_supported if
++ * Some devices may pass our check in pci_intx_mask_supported() if
+ * PCI_COMMAND_INTX_DISABLE works though they actually do not properly
+ * support this feature.
+ */
+@@ -3150,6 +3151,7 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CH
+ quirk_broken_intx_masking);
+ DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */
+ quirk_broken_intx_masking);
++
+ /*
+ * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10)
+ * Subsystem: Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC
+@@ -3158,8 +3160,6 @@ DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601,
+ */
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_REALTEK, 0x8169,
+ quirk_broken_intx_masking);
+-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
+- quirk_broken_intx_masking);
+
+ /*
+ * Intel i40e (XL710/X710) 10/20/40GbE NICs all have broken INTx masking,
+@@ -3194,6 +3194,40 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d2,
+ quirk_broken_intx_masking);
+
++static u16 mellanox_broken_intx_devs[] = {
++ PCI_DEVICE_ID_MELLANOX_HERMON_SDR,
++ PCI_DEVICE_ID_MELLANOX_HERMON_DDR,
++ PCI_DEVICE_ID_MELLANOX_HERMON_QDR,
++ PCI_DEVICE_ID_MELLANOX_HERMON_DDR_GEN2,
++ PCI_DEVICE_ID_MELLANOX_HERMON_QDR_GEN2,
++ PCI_DEVICE_ID_MELLANOX_HERMON_EN,
++ PCI_DEVICE_ID_MELLANOX_HERMON_EN_GEN2,
++ PCI_DEVICE_ID_MELLANOX_CONNECTX_EN,
++ PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_T_GEN2,
++ PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_GEN2,
++ PCI_DEVICE_ID_MELLANOX_CONNECTX_EN_5_GEN2,
++ PCI_DEVICE_ID_MELLANOX_CONNECTX2,
++ PCI_DEVICE_ID_MELLANOX_CONNECTX3,
++ PCI_DEVICE_ID_MELLANOX_CONNECTX3_PRO,
++ PCI_DEVICE_ID_MELLANOX_CONNECTIB,
++ PCI_DEVICE_ID_MELLANOX_CONNECTX4,
++ PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX,
++};
++
++static void mellanox_check_broken_intx_masking(struct pci_dev *pdev)
++{
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(mellanox_broken_intx_devs); i++) {
++ if (pdev->device == mellanox_broken_intx_devs[i]) {
++ pdev->broken_intx_masking = 1;
++ return;
++ }
++ }
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
++ mellanox_check_broken_intx_masking);
++
+ static void quirk_no_bus_reset(struct pci_dev *dev)
+ {
+ dev->dev_flags |= PCI_DEV_FLAGS_NO_BUS_RESET;
--- /dev/null
+From 1c7de2b4ff886a45fbd2f4c3d4627e0f37a9dd77 Mon Sep 17 00:00:00 2001
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+Date: Mon, 24 Oct 2016 18:04:17 +1100
+Subject: PCI: Enable access to non-standard VPD for Chelsio devices (cxgb3)
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+commit 1c7de2b4ff886a45fbd2f4c3d4627e0f37a9dd77 upstream.
+
+There is at least one Chelsio 10Gb card which uses VPD area to store some
+non-standard blocks (example below). However pci_vpd_size() returns the
+length of the first block only assuming that there can be only one VPD "End
+Tag".
+
+Since 4e1a635552d3 ("vfio/pci: Use kernel VPD access functions"), VFIO
+blocks access beyond that offset, which prevents the guest "cxgb3" driver
+from probing the device. The host system does not have this problem as its
+driver accesses the config space directly without pci_read_vpd().
+
+Add a quirk to override the VPD size to a bigger value. The maximum size
+is taken from EEPROMSIZE in drivers/net/ethernet/chelsio/cxgb3/common.h.
+We do not read the tag as the cxgb3 driver does as the driver supports
+writing to EEPROM/VPD and when it writes, it only checks for 8192 bytes
+boundary. The quirk is registered for all devices supported by the cxgb3
+driver.
+
+This adds a quirk to the PCI layer (not to the cxgb3 driver) as the cxgb3
+driver itself accesses VPD directly and the problem only exists with the
+vfio-pci driver (when cxgb3 is not running on the host and may not be even
+loaded) which blocks accesses beyond the first block of VPD data. However
+vfio-pci itself does not have quirks mechanism so we add it to PCI.
+
+This is the controller:
+Ethernet controller [0200]: Chelsio Communications Inc T310 10GbE Single Port Adapter [1425:0030]
+
+This is what I parsed from its VPD:
+===
+b'\x82*\x0010 Gigabit Ethernet-SR PCI Express Adapter\x90J\x00EC\x07D76809 FN\x0746K'
+ 0000 Large item 42 bytes; name 0x2 Identifier String
+ b'10 Gigabit Ethernet-SR PCI Express Adapter'
+ 002d Large item 74 bytes; name 0x10
+ #00 [EC] len=7: b'D76809 '
+ #0a [FN] len=7: b'46K7897'
+ #14 [PN] len=7: b'46K7897'
+ #1e [MN] len=4: b'1037'
+ #25 [FC] len=4: b'5769'
+ #2c [SN] len=12: b'YL102035603V'
+ #3b [NA] len=12: b'00145E992ED1'
+ 007a Small item 1 bytes; name 0xf End Tag
+
+ 0c00 Large item 16 bytes; name 0x2 Identifier String
+ b'S310E-SR-X '
+ 0c13 Large item 234 bytes; name 0x10
+ #00 [PN] len=16: b'TBD '
+ #13 [EC] len=16: b'110107730D2 '
+ #26 [SN] len=16: b'97YL102035603V '
+ #39 [NA] len=12: b'00145E992ED1'
+ #48 [V0] len=6: b'175000'
+ #51 [V1] len=6: b'266666'
+ #5a [V2] len=6: b'266666'
+ #63 [V3] len=6: b'2000 '
+ #6c [V4] len=2: b'1 '
+ #71 [V5] len=6: b'c2 '
+ #7a [V6] len=6: b'0 '
+ #83 [V7] len=2: b'1 '
+ #88 [V8] len=2: b'0 '
+ #8d [V9] len=2: b'0 '
+ #92 [VA] len=2: b'0 '
+ #97 [RV] len=80: b's\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...
+ 0d00 Large item 252 bytes; name 0x11
+ #00 [VC] len=16: b'122310_1222 dp '
+ #13 [VD] len=16: b'610-0001-00 H1\x00\x00'
+ #26 [VE] len=16: b'122310_1353 fp '
+ #39 [VF] len=16: b'610-0001-00 H1\x00\x00'
+ #4c [RW] len=173: b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'...
+ 0dff Small item 0 bytes; name 0xf End Tag
+
+10f3 Large item 13315 bytes; name 0x62
+!!! unknown item name 98: b'\xd0\x03\x00@`\x0c\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00'
+===
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/quirks.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3342,6 +3342,25 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE,
+ quirk_thunderbolt_hotplug_msi);
+
++static void quirk_chelsio_extend_vpd(struct pci_dev *dev)
++{
++ pci_set_vpd_size(dev, 8192);
++}
++
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd);
++
+ #ifdef CONFIG_ACPI
+ /*
+ * Apple: Shutdown Cactus Ridge Thunderbolt controller.
--- /dev/null
+From d1d111e073840b8dbc1ae90ba3fc274736451bdc Mon Sep 17 00:00:00 2001
+From: Jan Beulich <JBeulich@suse.com>
+Date: Tue, 8 Nov 2016 00:43:54 -0700
+Subject: PCI/MSI: Check for NULL affinity mask in pci_irq_get_affinity()
+
+From: Jan Beulich <JBeulich@suse.com>
+
+commit d1d111e073840b8dbc1ae90ba3fc274736451bdc upstream.
+
+If msi_setup_entry() fails to allocate an affinity mask, it logs a message
+but continues on and allocates an MSI entry with entry->affinity == NULL.
+
+Check for this case in pci_irq_get_affinity() so we don't try to
+dereference a NULL pointer.
+
+[bhelgaas: changelog]
+Fixes: ee8d41e53efe "pci/msi: Retrieve affinity for a vector"
+Signed-off-by: Jan Beulich <jbeulich@suse.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+CC: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/msi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -1294,7 +1294,8 @@ const struct cpumask *pci_irq_get_affini
+ } else if (dev->msi_enabled) {
+ struct msi_desc *entry = first_pci_msi_entry(dev);
+
+- if (WARN_ON_ONCE(!entry || nr >= entry->nvec_used))
++ if (WARN_ON_ONCE(!entry || !entry->affinity ||
++ nr >= entry->nvec_used))
+ return NULL;
+
+ return &entry->affinity[nr];
--- /dev/null
+From a45e2611b9bbd81288d97d02ce7e74a60a698d43 Mon Sep 17 00:00:00 2001
+From: Brian Norris <briannorris@chromium.org>
+Date: Wed, 7 Dec 2016 15:06:00 -0600
+Subject: PCI: rockchip: Correct the use of FTS mask
+
+From: Brian Norris <briannorris@chromium.org>
+
+commit a45e2611b9bbd81288d97d02ce7e74a60a698d43 upstream.
+
+We're trying to mask out bits[23:8] while retaining [32:24, 7:0], but we're
+doing the inverse. That doesn't have too much effect, since we're setting
+all the [23:8] bits to 1, and the other bits are only relevant for modes
+we're currently not using. But we should get this right.
+
+Fixes: ca1989084054 ("PCI: rockchip: Fix wrong transmitted FTS count")
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pcie-rockchip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/host/pcie-rockchip.c
++++ b/drivers/pci/host/pcie-rockchip.c
+@@ -533,7 +533,7 @@ static int rockchip_pcie_init_port(struc
+
+ /* Fix the transmitted FTS count desired to exit from L0s. */
+ status = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL_PLC1);
+- status = (status & PCIE_CORE_CTRL_PLC1_FTS_MASK) |
++ status = (status & ~PCIE_CORE_CTRL_PLC1_FTS_MASK) |
+ (PCIE_CORE_CTRL_PLC1_FTS_CNT << PCIE_CORE_CTRL_PLC1_FTS_SHIFT);
+ rockchip_pcie_write(rockchip, status, PCIE_CORE_CTRL_PLC1);
+
--- /dev/null
+From 45e9320f3a4ef9588ee50a2eb1891c4bfdbb07df Mon Sep 17 00:00:00 2001
+From: Shawn Lin <shawn.lin@rock-chips.com>
+Date: Wed, 7 Dec 2016 15:05:59 -0600
+Subject: PCI: rockchip: Fix negotiated lanes calculation
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+commit 45e9320f3a4ef9588ee50a2eb1891c4bfdbb07df upstream.
+
+The calculation of negotiated lanes is wrong: it should be shifted by
+PCIE_CORE_PL_CONF_LANE_SHIFT, but it is shifted by
+PCIE_CORE_PL_CONF_LANE_MASK instead. Let's fix it.
+
+Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support")
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/host/pcie-rockchip.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/host/pcie-rockchip.c
++++ b/drivers/pci/host/pcie-rockchip.c
+@@ -590,8 +590,8 @@ static int rockchip_pcie_init_port(struc
+
+ /* Check the final link width from negotiated lane counter from MGMT */
+ status = rockchip_pcie_read(rockchip, PCIE_CORE_CTRL);
+- status = 0x1 << ((status & PCIE_CORE_PL_CONF_LANE_MASK) >>
+- PCIE_CORE_PL_CONF_LANE_MASK);
++ status = 0x1 << ((status & PCIE_CORE_PL_CONF_LANE_MASK) >>
++ PCIE_CORE_PL_CONF_LANE_SHIFT);
+ dev_dbg(dev, "current link width is x%d\n", status);
+
+ rockchip_pcie_write(rockchip, ROCKCHIP_VENDOR_ID,
--- /dev/null
+From 1600f62534b7b3da7978b43b52231a54c24df287 Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Tue, 15 Nov 2016 10:00:00 +0200
+Subject: PCI: Support INTx masking on ConnectX-4 with firmware x.14.1100+
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 1600f62534b7b3da7978b43b52231a54c24df287 upstream.
+
+Mellanox devices were marked as having INTx masking ability broken. As a
+result, the VFIO driver fails to start when more than one device function
+is passed-through to a VM if both have the same INTx pin.
+
+Prior to Connect-IB, Mellanox devices exposed to the operating system one
+PCI function per all ports. Starting from Connect-IB, the devices are
+function-per-port. When passing the second function to a VM, VFIO will
+fail to start.
+
+Exclude ConnectX-4, ConnectX4-Lx and Connect-IB from the list of Mellanox
+devices marked as having broken INTx masking:
+
+- ConnectX-4 and ConnectX4-LX firmware version is checked. If INTx
+ masking is supported, we unmark the broken INTx masking.
+- Connect-IB does not support INTx currently so will not cause any
+ problem.
+
+[bhelgaas: call pci_disable_device() always, after iounmap()]
+Fixes: 11e42532ada3 ("PCI: Assume all Mellanox devices have broken INTx masking")
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
+Reviewed-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/quirks.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 56 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3209,13 +3209,25 @@ static u16 mellanox_broken_intx_devs[] =
+ PCI_DEVICE_ID_MELLANOX_CONNECTX2,
+ PCI_DEVICE_ID_MELLANOX_CONNECTX3,
+ PCI_DEVICE_ID_MELLANOX_CONNECTX3_PRO,
+- PCI_DEVICE_ID_MELLANOX_CONNECTIB,
+- PCI_DEVICE_ID_MELLANOX_CONNECTX4,
+- PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX,
+ };
+
++#define CONNECTX_4_CURR_MAX_MINOR 99
++#define CONNECTX_4_INTX_SUPPORT_MINOR 14
++
++/*
++ * Check ConnectX-4/LX FW version to see if it supports legacy interrupts.
++ * If so, don't mark it as broken.
++ * FW minor > 99 means older FW version format and no INTx masking support.
++ * FW minor < 14 means new FW version format and no INTx masking support.
++ */
+ static void mellanox_check_broken_intx_masking(struct pci_dev *pdev)
+ {
++ __be32 __iomem *fw_ver;
++ u16 fw_major;
++ u16 fw_minor;
++ u16 fw_subminor;
++ u32 fw_maj_min;
++ u32 fw_sub_min;
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(mellanox_broken_intx_devs); i++) {
+@@ -3224,6 +3236,47 @@ static void mellanox_check_broken_intx_m
+ return;
+ }
+ }
++
++ /* Getting here means Connect-IB cards and up. Connect-IB has no INTx
++ * support so shouldn't be checked further
++ */
++ if (pdev->device == PCI_DEVICE_ID_MELLANOX_CONNECTIB)
++ return;
++
++ if (pdev->device != PCI_DEVICE_ID_MELLANOX_CONNECTX4 &&
++ pdev->device != PCI_DEVICE_ID_MELLANOX_CONNECTX4_LX)
++ return;
++
++ /* For ConnectX-4 and ConnectX-4LX, need to check FW support */
++ if (pci_enable_device_mem(pdev)) {
++ dev_warn(&pdev->dev, "Can't enable device memory\n");
++ return;
++ }
++
++ fw_ver = ioremap(pci_resource_start(pdev, 0), 4);
++ if (!fw_ver) {
++ dev_warn(&pdev->dev, "Can't map ConnectX-4 initialization segment\n");
++ goto out;
++ }
++
++ /* Reading from resource space should be 32b aligned */
++ fw_maj_min = ioread32be(fw_ver);
++ fw_sub_min = ioread32be(fw_ver + 1);
++ fw_major = fw_maj_min & 0xffff;
++ fw_minor = fw_maj_min >> 16;
++ fw_subminor = fw_sub_min & 0xffff;
++ if (fw_minor > CONNECTX_4_CURR_MAX_MINOR ||
++ fw_minor < CONNECTX_4_INTX_SUPPORT_MINOR) {
++ dev_warn(&pdev->dev, "ConnectX-4: FW %u.%u.%u doesn't support INTx masking, disabling. Please upgrade FW to %d.14.1100 and up for INTx support\n",
++ fw_major, fw_minor, fw_subminor, pdev->device ==
++ PCI_DEVICE_ID_MELLANOX_CONNECTX4 ? 12 : 14);
++ pdev->broken_intx_masking = 1;
++ }
++
++ iounmap(fw_ver);
++
++out:
++ pci_disable_device(pdev);
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_MELLANOX, PCI_ANY_ID,
+ mellanox_check_broken_intx_masking);
--- /dev/null
+From a608a9d52fa4168efd478d684039ed545a69dbcd Mon Sep 17 00:00:00 2001
+From: Micha? K?pie? <kernel@kempniu.pl>
+Date: Fri, 23 Dec 2016 10:00:08 +0100
+Subject: platform/x86: fujitsu-laptop: use brightness_set_blocking for LED-setting callbacks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Micha? K?pie? <kernel@kempniu.pl>
+
+commit a608a9d52fa4168efd478d684039ed545a69dbcd upstream.
+
+All LED-setting functions in fujitsu-laptop are currently assigned to
+the brightness_set callback, which is incorrect because they can sleep
+(due to their use of call_fext_func(), which in turn issues ACPI calls)
+and the documentation (in include/linux/leds.h) clearly states they must
+not. Assign them to brightness_set_blocking instead and change them to
+match the expected function prototype.
+
+This change makes it possible to use Fujitsu-specific LEDs with "heavy"
+triggers, like disk-activity or phy0rx.
+
+Fixes: 3a407086090b ("fujitsu-laptop: Add BL power, LED control and radio state information")
+Fixes: 4f62568c1fcf ("fujitsu-laptop: Support radio LED")
+Fixes: d6b88f64b0d4 ("fujitsu-laptop: Add support for eco LED")
+Signed-off-by: Michał Kępień <kernel@kempniu.pl>
+Acked-by: Jonathan Woithe <jwoithe@just42.net>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/fujitsu-laptop.c | 42 +++++++++++++++++-----------------
+ 1 file changed, 21 insertions(+), 21 deletions(-)
+
+--- a/drivers/platform/x86/fujitsu-laptop.c
++++ b/drivers/platform/x86/fujitsu-laptop.c
+@@ -177,43 +177,43 @@ static void acpi_fujitsu_hotkey_notify(s
+
+ #if IS_ENABLED(CONFIG_LEDS_CLASS)
+ static enum led_brightness logolamp_get(struct led_classdev *cdev);
+-static void logolamp_set(struct led_classdev *cdev,
++static int logolamp_set(struct led_classdev *cdev,
+ enum led_brightness brightness);
+
+ static struct led_classdev logolamp_led = {
+ .name = "fujitsu::logolamp",
+ .brightness_get = logolamp_get,
+- .brightness_set = logolamp_set
++ .brightness_set_blocking = logolamp_set
+ };
+
+ static enum led_brightness kblamps_get(struct led_classdev *cdev);
+-static void kblamps_set(struct led_classdev *cdev,
++static int kblamps_set(struct led_classdev *cdev,
+ enum led_brightness brightness);
+
+ static struct led_classdev kblamps_led = {
+ .name = "fujitsu::kblamps",
+ .brightness_get = kblamps_get,
+- .brightness_set = kblamps_set
++ .brightness_set_blocking = kblamps_set
+ };
+
+ static enum led_brightness radio_led_get(struct led_classdev *cdev);
+-static void radio_led_set(struct led_classdev *cdev,
++static int radio_led_set(struct led_classdev *cdev,
+ enum led_brightness brightness);
+
+ static struct led_classdev radio_led = {
+ .name = "fujitsu::radio_led",
+ .brightness_get = radio_led_get,
+- .brightness_set = radio_led_set
++ .brightness_set_blocking = radio_led_set
+ };
+
+ static enum led_brightness eco_led_get(struct led_classdev *cdev);
+-static void eco_led_set(struct led_classdev *cdev,
++static int eco_led_set(struct led_classdev *cdev,
+ enum led_brightness brightness);
+
+ static struct led_classdev eco_led = {
+ .name = "fujitsu::eco_led",
+ .brightness_get = eco_led_get,
+- .brightness_set = eco_led_set
++ .brightness_set_blocking = eco_led_set
+ };
+ #endif
+
+@@ -267,48 +267,48 @@ static int call_fext_func(int cmd, int a
+ #if IS_ENABLED(CONFIG_LEDS_CLASS)
+ /* LED class callbacks */
+
+-static void logolamp_set(struct led_classdev *cdev,
++static int logolamp_set(struct led_classdev *cdev,
+ enum led_brightness brightness)
+ {
+ if (brightness >= LED_FULL) {
+ call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_ON);
+- call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_ON);
++ return call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_ON);
+ } else if (brightness >= LED_HALF) {
+ call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_ON);
+- call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_OFF);
++ return call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_ALWAYS, FUNC_LED_OFF);
+ } else {
+- call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_OFF);
++ return call_fext_func(FUNC_LEDS, 0x1, LOGOLAMP_POWERON, FUNC_LED_OFF);
+ }
+ }
+
+-static void kblamps_set(struct led_classdev *cdev,
++static int kblamps_set(struct led_classdev *cdev,
+ enum led_brightness brightness)
+ {
+ if (brightness >= LED_FULL)
+- call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_ON);
++ return call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_ON);
+ else
+- call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_OFF);
++ return call_fext_func(FUNC_LEDS, 0x1, KEYBOARD_LAMPS, FUNC_LED_OFF);
+ }
+
+-static void radio_led_set(struct led_classdev *cdev,
++static int radio_led_set(struct led_classdev *cdev,
+ enum led_brightness brightness)
+ {
+ if (brightness >= LED_FULL)
+- call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, RADIO_LED_ON);
++ return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, RADIO_LED_ON);
+ else
+- call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, 0x0);
++ return call_fext_func(FUNC_RFKILL, 0x5, RADIO_LED_ON, 0x0);
+ }
+
+-static void eco_led_set(struct led_classdev *cdev,
++static int eco_led_set(struct led_classdev *cdev,
+ enum led_brightness brightness)
+ {
+ int curr;
+
+ curr = call_fext_func(FUNC_LEDS, 0x2, ECO_LED, 0x0);
+ if (brightness >= LED_FULL)
+- call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr | ECO_LED_ON);
++ return call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr | ECO_LED_ON);
+ else
+- call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr & ~ECO_LED_ON);
++ return call_fext_func(FUNC_LEDS, 0x1, ECO_LED, curr & ~ECO_LED_ON);
+ }
+
+ static enum led_brightness logolamp_get(struct led_classdev *cdev)
--- /dev/null
+From bed570307ed78f21b77cb04a1df781dee4a8f05a Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 5 Dec 2016 16:38:16 -0800
+Subject: PM / wakeirq: Fix dedicated wakeirq for drivers not using autosuspend
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit bed570307ed78f21b77cb04a1df781dee4a8f05a upstream.
+
+I noticed some wakeirq flakeyness with consumer drivers not using
+autosuspend. For drivers not using autosuspend, the wakeirq may never
+get unmasked in rpm_suspend() because of irq desc->depth.
+
+We are configuring dedicated wakeirqs to start with IRQ_NOAUTOEN as we
+naturally don't want them running until rpm_suspend() is called.
+
+However, when a consumer driver initially calls pm_runtime_get(), we
+now wrongly start with disable_irq_nosync() call on the dedicated
+wakeirq that is disabled to start with.
+
+This causes desc->depth to toggle between 1 and 2 instead of the usual
+0 and 1. This can prevent enable_irq() from unmasking the wakeirq as
+that only happens at desc->depth 1.
+
+This does not necessarily show up with drivers using autosuspend as
+there is time for disable_irq_nosync() before rpm_suspend() gets called
+after the autosuspend timeout.
+
+Let's fix the issue by adding wirq->status that lazily gets set on
+the first rpm_suspend(). We also need PM runtime core private functions
+for dev_pm_enable_wake_irq_check() and dev_pm_disable_wake_irq_check()
+so we can enable the dedicated wakeirq on the first rpm_suspend().
+
+While at it, let's also fix the comments for dev_pm_enable_wake_irq()
+and dev_pm_disable_wake_irq(). Those can still be used by the consumer
+drivers as needed because the IRQ core manages the interrupt usecount
+for us.
+
+Fixes: 4990d4fe327b (PM / Wakeirq: Add automated device wake IRQ handling)
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/power/power.h | 19 ++++++++++
+ drivers/base/power/runtime.c | 8 ++--
+ drivers/base/power/wakeirq.c | 76 +++++++++++++++++++++++++++++++++++++------
+ 3 files changed, 88 insertions(+), 15 deletions(-)
+
+--- a/drivers/base/power/power.h
++++ b/drivers/base/power/power.h
+@@ -21,14 +21,22 @@ extern void pm_runtime_init(struct devic
+ extern void pm_runtime_reinit(struct device *dev);
+ extern void pm_runtime_remove(struct device *dev);
+
++#define WAKE_IRQ_DEDICATED_ALLOCATED BIT(0)
++#define WAKE_IRQ_DEDICATED_MANAGED BIT(1)
++#define WAKE_IRQ_DEDICATED_MASK (WAKE_IRQ_DEDICATED_ALLOCATED | \
++ WAKE_IRQ_DEDICATED_MANAGED)
++
+ struct wake_irq {
+ struct device *dev;
++ unsigned int status;
+ int irq;
+- bool dedicated_irq:1;
+ };
+
+ extern void dev_pm_arm_wake_irq(struct wake_irq *wirq);
+ extern void dev_pm_disarm_wake_irq(struct wake_irq *wirq);
++extern void dev_pm_enable_wake_irq_check(struct device *dev,
++ bool can_change_status);
++extern void dev_pm_disable_wake_irq_check(struct device *dev);
+
+ #ifdef CONFIG_PM_SLEEP
+
+@@ -104,6 +112,15 @@ static inline void dev_pm_disarm_wake_ir
+ {
+ }
+
++static inline void dev_pm_enable_wake_irq_check(struct device *dev,
++ bool can_change_status)
++{
++}
++
++static inline void dev_pm_disable_wake_irq_check(struct device *dev)
++{
++}
++
+ #endif
+
+ #ifdef CONFIG_PM_SLEEP
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -515,7 +515,7 @@ static int rpm_suspend(struct device *de
+
+ callback = RPM_GET_CALLBACK(dev, runtime_suspend);
+
+- dev_pm_enable_wake_irq(dev);
++ dev_pm_enable_wake_irq_check(dev, true);
+ retval = rpm_callback(callback, dev);
+ if (retval)
+ goto fail;
+@@ -554,7 +554,7 @@ static int rpm_suspend(struct device *de
+ return retval;
+
+ fail:
+- dev_pm_disable_wake_irq(dev);
++ dev_pm_disable_wake_irq_check(dev);
+ __update_runtime_status(dev, RPM_ACTIVE);
+ dev->power.deferred_resume = false;
+ wake_up_all(&dev->power.wait_queue);
+@@ -737,12 +737,12 @@ static int rpm_resume(struct device *dev
+
+ callback = RPM_GET_CALLBACK(dev, runtime_resume);
+
+- dev_pm_disable_wake_irq(dev);
++ dev_pm_disable_wake_irq_check(dev);
+ retval = rpm_callback(callback, dev);
+ if (retval) {
+ __update_runtime_status(dev, RPM_SUSPENDED);
+ pm_runtime_cancel_pending(dev);
+- dev_pm_enable_wake_irq(dev);
++ dev_pm_enable_wake_irq_check(dev, false);
+ } else {
+ no_callback:
+ __update_runtime_status(dev, RPM_ACTIVE);
+--- a/drivers/base/power/wakeirq.c
++++ b/drivers/base/power/wakeirq.c
+@@ -110,8 +110,10 @@ void dev_pm_clear_wake_irq(struct device
+ dev->power.wakeirq = NULL;
+ spin_unlock_irqrestore(&dev->power.lock, flags);
+
+- if (wirq->dedicated_irq)
++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) {
+ free_irq(wirq->irq, wirq);
++ wirq->status &= ~WAKE_IRQ_DEDICATED_MASK;
++ }
+ kfree(wirq);
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_clear_wake_irq);
+@@ -179,7 +181,6 @@ int dev_pm_set_dedicated_wake_irq(struct
+
+ wirq->dev = dev;
+ wirq->irq = irq;
+- wirq->dedicated_irq = true;
+ irq_set_status_flags(irq, IRQ_NOAUTOEN);
+
+ /*
+@@ -195,6 +196,8 @@ int dev_pm_set_dedicated_wake_irq(struct
+ if (err)
+ goto err_free_irq;
+
++ wirq->status = WAKE_IRQ_DEDICATED_ALLOCATED;
++
+ return err;
+
+ err_free_irq:
+@@ -210,9 +213,9 @@ EXPORT_SYMBOL_GPL(dev_pm_set_dedicated_w
+ * dev_pm_enable_wake_irq - Enable device wake-up interrupt
+ * @dev: Device
+ *
+- * Called from the bus code or the device driver for
+- * runtime_suspend() to enable the wake-up interrupt while
+- * the device is running.
++ * Optionally called from the bus code or the device driver for
++ * runtime_resume() to override the PM runtime core managed wake-up
++ * interrupt handling to enable the wake-up interrupt.
+ *
+ * Note that for runtime_suspend()) the wake-up interrupts
+ * should be unconditionally enabled unlike for suspend()
+@@ -222,7 +225,7 @@ void dev_pm_enable_wake_irq(struct devic
+ {
+ struct wake_irq *wirq = dev->power.wakeirq;
+
+- if (wirq && wirq->dedicated_irq)
++ if (wirq && (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED))
+ enable_irq(wirq->irq);
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_enable_wake_irq);
+@@ -231,20 +234,73 @@ EXPORT_SYMBOL_GPL(dev_pm_enable_wake_irq
+ * dev_pm_disable_wake_irq - Disable device wake-up interrupt
+ * @dev: Device
+ *
+- * Called from the bus code or the device driver for
+- * runtime_resume() to disable the wake-up interrupt while
+- * the device is running.
++ * Optionally called from the bus code or the device driver for
++ * runtime_suspend() to override the PM runtime core managed wake-up
++ * interrupt handling to disable the wake-up interrupt.
+ */
+ void dev_pm_disable_wake_irq(struct device *dev)
+ {
+ struct wake_irq *wirq = dev->power.wakeirq;
+
+- if (wirq && wirq->dedicated_irq)
++ if (wirq && (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED))
+ disable_irq_nosync(wirq->irq);
+ }
+ EXPORT_SYMBOL_GPL(dev_pm_disable_wake_irq);
+
+ /**
++ * dev_pm_enable_wake_irq_check - Checks and enables wake-up interrupt
++ * @dev: Device
++ * @can_change_status: Can change wake-up interrupt status
++ *
++ * Enables wakeirq conditionally. We need to enable wake-up interrupt
++ * lazily on the first rpm_suspend(). This is needed as the consumer device
++ * starts in RPM_SUSPENDED state, and the the first pm_runtime_get() would
++ * otherwise try to disable already disabled wakeirq. The wake-up interrupt
++ * starts disabled with IRQ_NOAUTOEN set.
++ *
++ * Should be only called from rpm_suspend() and rpm_resume() path.
++ * Caller must hold &dev->power.lock to change wirq->status
++ */
++void dev_pm_enable_wake_irq_check(struct device *dev,
++ bool can_change_status)
++{
++ struct wake_irq *wirq = dev->power.wakeirq;
++
++ if (!wirq || !((wirq->status & WAKE_IRQ_DEDICATED_MASK)))
++ return;
++
++ if (likely(wirq->status & WAKE_IRQ_DEDICATED_MANAGED)) {
++ goto enable;
++ } else if (can_change_status) {
++ wirq->status |= WAKE_IRQ_DEDICATED_MANAGED;
++ goto enable;
++ }
++
++ return;
++
++enable:
++ enable_irq(wirq->irq);
++}
++
++/**
++ * dev_pm_disable_wake_irq_check - Checks and disables wake-up interrupt
++ * @dev: Device
++ *
++ * Disables wake-up interrupt conditionally based on status.
++ * Should be only called from rpm_suspend() and rpm_resume() path.
++ */
++void dev_pm_disable_wake_irq_check(struct device *dev)
++{
++ struct wake_irq *wirq = dev->power.wakeirq;
++
++ if (!wirq || !((wirq->status & WAKE_IRQ_DEDICATED_MASK)))
++ return;
++
++ if (wirq->status & WAKE_IRQ_DEDICATED_MANAGED)
++ disable_irq_nosync(wirq->irq);
++}
++
++/**
+ * dev_pm_arm_wake_irq - Arm device wake-up
+ * @wirq: Device wake-up interrupt
+ *
--- /dev/null
+From 99e5cde5eae78bef95bfe7c16ccda87fb070149b Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 1 Nov 2016 16:26:03 +0100
+Subject: powerpc/pci/rpadlpar: Fix device reference leaks
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 99e5cde5eae78bef95bfe7c16ccda87fb070149b upstream.
+
+Make sure to drop any device reference taken by vio_find_node() when
+adding and removing virtual I/O slots.
+
+Fixes: 5eeb8c63a38f ("[PATCH] PCI Hotplug: rpaphp: Move VIO registration")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/hotplug/rpadlpar_core.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/hotplug/rpadlpar_core.c
++++ b/drivers/pci/hotplug/rpadlpar_core.c
+@@ -257,8 +257,13 @@ static int dlpar_add_phb(char *drc_name,
+
+ static int dlpar_add_vio_slot(char *drc_name, struct device_node *dn)
+ {
+- if (vio_find_node(dn))
++ struct vio_dev *vio_dev;
++
++ vio_dev = vio_find_node(dn);
++ if (vio_dev) {
++ put_device(&vio_dev->dev);
+ return -EINVAL;
++ }
+
+ if (!vio_register_device_node(dn)) {
+ printk(KERN_ERR
+@@ -334,6 +339,9 @@ static int dlpar_remove_vio_slot(char *d
+ return -EINVAL;
+
+ vio_unregister_device(vio_dev);
++
++ put_device(&vio_dev->dev);
++
+ return 0;
+ }
+
--- /dev/null
+From 9a29d0fbc2d9ad99fb8a981ab72548cc360e9d4c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 14 Dec 2016 15:05:38 -0800
+Subject: relay: check array offset before using it
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 9a29d0fbc2d9ad99fb8a981ab72548cc360e9d4c upstream.
+
+Smatch complains that we started using the array offset before we
+checked that it was valid.
+
+Fixes: 017c59c042d0 ('relay: Use per CPU constructs for the relay channel buffer pointers')
+Link: http://lkml.kernel.org/r/20161013084947.GC16198@mwanda
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/relay.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/relay.c
++++ b/kernel/relay.c
+@@ -809,11 +809,11 @@ void relay_subbufs_consumed(struct rchan
+ {
+ struct rchan_buf *buf;
+
+- if (!chan)
++ if (!chan || cpu >= NR_CPUS)
+ return;
+
+ buf = *per_cpu_ptr(chan->buf, cpu);
+- if (cpu >= NR_CPUS || !buf || subbufs_consumed > chan->n_subbufs)
++ if (!buf || subbufs_consumed > chan->n_subbufs)
+ return;
+
+ if (subbufs_consumed > buf->subbufs_produced - buf->subbufs_consumed)
--- /dev/null
+From 1d74e7ed5dc1903ac081574a9b6aa94e7ba4ad45 Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Thu, 1 Dec 2016 16:59:55 -0800
+Subject: rpmsg: qcom_smd: Correct return value for O_NONBLOCK
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+commit 1d74e7ed5dc1903ac081574a9b6aa94e7ba4ad45 upstream.
+
+qcom_smd_send() should return -EAGAIN for non-blocking channels with
+insufficient space, so that we can propagate this event to user space.
+
+Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rpmsg/qcom_smd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/rpmsg/qcom_smd.c
++++ b/drivers/rpmsg/qcom_smd.c
+@@ -739,7 +739,7 @@ static int __qcom_smd_send(struct qcom_s
+
+ while (qcom_smd_get_tx_avail(channel) < tlen) {
+ if (!wait) {
+- ret = -ENOMEM;
++ ret = -EAGAIN;
+ goto out;
+ }
+
--- /dev/null
+From 9e6e7c74315095fd40f41003850690c711e44420 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 18 Nov 2016 14:11:00 +0300
+Subject: s390/crypto: unlock on error in prng_tdes_read()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 9e6e7c74315095fd40f41003850690c711e44420 upstream.
+
+We added some new locking but forgot to unlock on error.
+
+Fixes: 57127645d79d ("s390/zcrypt: Introduce new SHA-512 based Pseudo Random Generator.")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/crypto/prng.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/s390/crypto/prng.c
++++ b/arch/s390/crypto/prng.c
+@@ -507,8 +507,10 @@ static ssize_t prng_tdes_read(struct fil
+ prng_data->prngws.byte_counter += n;
+ prng_data->prngws.reseed_counter += n;
+
+- if (copy_to_user(ubuf, prng_data->buf, chunk))
+- return -EFAULT;
++ if (copy_to_user(ubuf, prng_data->buf, chunk)) {
++ ret = -EFAULT;
++ break;
++ }
+
+ nbytes -= chunk;
+ ret += chunk;
--- /dev/null
+From 6b7df3ce92ac82ec3f4a2953b6fed77da7b38aaa Mon Sep 17 00:00:00 2001
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Date: Mon, 7 Nov 2016 15:06:03 +0100
+Subject: s390/pci: fix dma address calculation in map_sg
+
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+
+commit 6b7df3ce92ac82ec3f4a2953b6fed77da7b38aaa upstream.
+
+__s390_dma_map_sg maps a dma-contiguous area. Although we only map
+whole pages we have to take into account that the area doesn't start
+or stop at a page boundary because we use the dma address to loop
+over the individual sg entries. Failing to do that might lead to an
+access of the wrong sg entry.
+
+Fixes: ee877b81c6b9 ("s390/pci_dma: improve map_sg")
+Reported-and-tested-by: Christoph Raisch <raisch@de.ibm.com>
+Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/pci/pci_dma.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/arch/s390/pci/pci_dma.c
++++ b/arch/s390/pci/pci_dma.c
+@@ -419,6 +419,7 @@ static int __s390_dma_map_sg(struct devi
+ size_t size, dma_addr_t *handle,
+ enum dma_data_direction dir)
+ {
++ unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+ struct zpci_dev *zdev = to_zpci(to_pci_dev(dev));
+ dma_addr_t dma_addr_base, dma_addr;
+ int flags = ZPCI_PTE_VALID;
+@@ -426,8 +427,7 @@ static int __s390_dma_map_sg(struct devi
+ unsigned long pa = 0;
+ int ret;
+
+- size = PAGE_ALIGN(size);
+- dma_addr_base = dma_alloc_address(dev, size >> PAGE_SHIFT);
++ dma_addr_base = dma_alloc_address(dev, nr_pages);
+ if (dma_addr_base == DMA_ERROR_CODE)
+ return -ENOMEM;
+
+@@ -436,26 +436,27 @@ static int __s390_dma_map_sg(struct devi
+ flags |= ZPCI_TABLE_PROTECTED;
+
+ for (s = sg; dma_addr < dma_addr_base + size; s = sg_next(s)) {
+- pa = page_to_phys(sg_page(s)) + s->offset;
+- ret = __dma_update_trans(zdev, pa, dma_addr, s->length, flags);
++ pa = page_to_phys(sg_page(s));
++ ret = __dma_update_trans(zdev, pa, dma_addr,
++ s->offset + s->length, flags);
+ if (ret)
+ goto unmap;
+
+- dma_addr += s->length;
++ dma_addr += s->offset + s->length;
+ }
+ ret = __dma_purge_tlb(zdev, dma_addr_base, size, flags);
+ if (ret)
+ goto unmap;
+
+ *handle = dma_addr_base;
+- atomic64_add(size >> PAGE_SHIFT, &zdev->mapped_pages);
++ atomic64_add(nr_pages, &zdev->mapped_pages);
+
+ return ret;
+
+ unmap:
+ dma_update_trans(zdev, 0, dma_addr_base, dma_addr - dma_addr_base,
+ ZPCI_PTE_INVALID);
+- dma_free_address(dev, dma_addr_base, size >> PAGE_SHIFT);
++ dma_free_address(dev, dma_addr_base, nr_pages);
+ zpci_err("map error:\n");
+ zpci_err_dma(ret, pa);
+ return ret;
--- /dev/null
+From ebb299a51059017ec253bd30781a83d1f6e11b24 Mon Sep 17 00:00:00 2001
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+Date: Sat, 3 Dec 2016 09:50:16 +0100
+Subject: s390/topology: always use s390 specific sched_domain_topology_level
+
+From: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+commit ebb299a51059017ec253bd30781a83d1f6e11b24 upstream.
+
+The s390 specific sched_domain_topology_level should always be used,
+not only if the machine provides topology information. Luckily this
+odd behaviour, that was by accident introduced with git commit
+d05d15da18f5 ("s390/topology: delay initialization of topology cpu
+masks") has currently no side effect.
+
+Fixes: d05d15da18f5 ("s390/topology: delay initialization of topology cpumasks")
+Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/kernel/topology.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/kernel/topology.c
++++ b/arch/s390/kernel/topology.c
+@@ -448,6 +448,7 @@ static int __init s390_topology_init(voi
+ struct sysinfo_15_1_x *info;
+ int i;
+
++ set_sched_topology(s390_topology);
+ if (!MACHINE_HAS_TOPOLOGY)
+ return 0;
+ tl_info = (struct sysinfo_15_1_x *)__get_free_page(GFP_KERNEL);
+@@ -460,7 +461,6 @@ static int __init s390_topology_init(voi
+ alloc_masks(info, &socket_info, 1);
+ alloc_masks(info, &book_info, 2);
+ alloc_masks(info, &drawer_info, 3);
+- set_sched_topology(s390_topology);
+ return 0;
+ }
+ early_initcall(s390_topology_init);
--- /dev/null
+From 8456066a57940b3884aa080c58b166567dc9de39 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+Date: Fri, 18 Nov 2016 15:40:31 -0800
+Subject: sbp-target: Fix second argument of percpu_ida_alloc()
+
+From: Bart Van Assche <bart.vanassche@sandisk.com>
+
+commit 8456066a57940b3884aa080c58b166567dc9de39 upstream.
+
+Pass a task state as second argument to percpu_ida_alloc().
+
+Fixes: commit 5a3ee221b543 ("sbp-target: Conversion to percpu_ida tag pre-allocation")
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Cc: Chris Boot <bootc@bootc.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/sbp/sbp_target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/sbp/sbp_target.c
++++ b/drivers/target/sbp/sbp_target.c
+@@ -928,7 +928,7 @@ static struct sbp_target_request *sbp_mg
+ struct sbp_target_request *req;
+ int tag;
+
+- tag = percpu_ida_alloc(&se_sess->sess_tag_pool, GFP_ATOMIC);
++ tag = percpu_ida_alloc(&se_sess->sess_tag_pool, TASK_RUNNING);
+ if (tag < 0)
+ return ERR_PTR(-ENOMEM);
+
--- /dev/null
+From 7b93ca43b7e21fbe6fb1a6f4ecce4a2f70f424a0 Mon Sep 17 00:00:00 2001
+From: Ondrej Zary <linux@rainbow-software.org>
+Date: Fri, 11 Nov 2016 10:00:20 +1100
+Subject: scsi: g_NCR5380: Fix release_region in error handling
+
+From: Ondrej Zary <linux@rainbow-software.org>
+
+commit 7b93ca43b7e21fbe6fb1a6f4ecce4a2f70f424a0 upstream.
+
+When a SW-configurable card is specified but not found, the driver
+releases wrong region, causing the following message in kernel log:
+Trying to free nonexistent resource <0000000000000000-000000000000000f>
+
+Fix it by assigning base earlier.
+
+Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
+Fixes: a8cfbcaec0c1 ("scsi: g_NCR5380: Stop using scsi_module.c")
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/g_NCR5380.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/g_NCR5380.c
++++ b/drivers/scsi/g_NCR5380.c
+@@ -170,12 +170,12 @@ static int generic_NCR5380_init_one(stru
+ if (ports[i]) {
+ /* At this point we have our region reserved */
+ magic_configure(i, 0, magic); /* no IRQ yet */
+- outb(0xc0, ports[i] + 9);
+- if (inb(ports[i] + 9) != 0x80) {
++ base = ports[i];
++ outb(0xc0, base + 9);
++ if (inb(base + 9) != 0x80) {
+ ret = -ENODEV;
+ goto out_release;
+ }
+- base = ports[i];
+ port_idx = i;
+ } else
+ return -EINVAL;
--- /dev/null
+From af15769ffab13d777e55fdef09d0762bf0c249c4 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 16 Nov 2016 16:08:34 +0100
+Subject: scsi: mvsas: fix command_active typo
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit af15769ffab13d777e55fdef09d0762bf0c249c4 upstream.
+
+gcc-7 notices that the condition in mvs_94xx_command_active looks
+suspicious:
+
+drivers/scsi/mvsas/mv_94xx.c: In function 'mvs_94xx_command_active':
+drivers/scsi/mvsas/mv_94xx.c:671:15: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]
+
+This was introduced when the mv_printk() statement got added, and leads
+to the condition being ignored. This is probably harmless.
+
+Changing '&&' to '&' makes the code look reasonable, as we check the
+command bit before setting and printing it.
+
+Fixes: a4632aae8b66 ("[SCSI] mvsas: Add new macros and functions")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mvsas/mv_94xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/mvsas/mv_94xx.c
++++ b/drivers/scsi/mvsas/mv_94xx.c
+@@ -668,7 +668,7 @@ static void mvs_94xx_command_active(stru
+ {
+ u32 tmp;
+ tmp = mvs_cr32(mvi, MVS_COMMAND_ACTIVE+(slot_idx >> 3));
+- if (tmp && 1 << (slot_idx % 32)) {
++ if (tmp & 1 << (slot_idx % 32)) {
+ mv_printk("command active %08X, slot [%x].\n", tmp, slot_idx);
+ mvs_cw32(mvi, MVS_COMMAND_ACTIVE + (slot_idx >> 3),
+ 1 << (slot_idx % 32));
efi-efivar_ssdt_load-don-t-return-success-on-allocation-failure.patch
clk-renesas-cpg-mssr-fix-inverted-debug-check.patch
debugfs-improve-define_debugfs_attribute-for-config_debug_fs.patch
+x86-prctl-uapi-remove-ifdef-for-checkpoint_restore.patch
+x86-cpu-probe-cpuid-leaf-6-even-when-cpuid_level-6.patch
+platform-x86-fujitsu-laptop-use-brightness_set_blocking-for-led-setting-callbacks.patch
+hwmon-scpi-fix-module-autoload.patch
+hwmon-amc6821-sign-extension-temperature.patch
+hwmon-ds620-fix-overflows-seen-when-writing-temperature-limits.patch
+hwmon-nct7802-fix-overflows-seen-when-writing-into-limit-attributes.patch
+hwmon-g762-fix-overflows-and-crash-seen-when-writing-limit-attributes.patch
+hwmon-lm90-fix-temp1_max_alarm-attribute.patch
+input-synaptics-rmi4-unlock-on-error.patch
+clk-qcom-ipq806x-fix-board-clk-rates.patch
+clk-clk-wm831x-fix-a-logic-error.patch
+clk-ti-dra7-fix-failed-to-lookup-clock-node-gmac_gmii_ref_clk_div-boot-message.patch
+clk-sunxi-ng-sun8i-a23-set-clk_set_rate_parent-for-audio-module-clocks.patch
+clk-sunxi-ng-sun8i-h3-set-clk_set_rate_parent-for-audio-module-clocks.patch
+clk-imx31-fix-rewritten-input-argument-of-mx31_clocks_init.patch
+clk-renesas-mstp-support-8-bit-registers-for-r7s72100.patch
+iommu-amd-missing-error-code-in-amd_iommu_init_device.patch
+iommu-amd-fix-the-left-value-check-of-cmd-buffer.patch
+iommu-vt-d-fix-pasid-table-size-encoding.patch
+iommu-vt-d-flush-old-iommu-caches-for-kdump-when-the-device-gets-context-mapped.patch
+asoc-lpass-platform-initialize-dma-channel-number.patch
+asoc-cht_bsw_rt5645-fix-leftover-kmalloc.patch
+asoc-intel-skylake-fix-a-shift-wrapping-bug.patch
+asoc-samsung-i2s-fixup-last-irq-unsafe-spin-lock-call.patch
+scsi-g_ncr5380-fix-release_region-in-error-handling.patch
+scsi-mvsas-fix-command_active-typo.patch
+target-iscsi-fix-double-free-in-lio_target_tiqn_addtpg.patch
+sbp-target-fix-second-argument-of-percpu_ida_alloc.patch
+relay-check-array-offset-before-using-it.patch
+ima-fix-memory-leak-in-ima_release_policy.patch
+pci-msi-check-for-null-affinity-mask-in-pci_irq_get_affinity.patch
+irqchip-bcm7038-l1-implement-irq_cpu_offline-callback.patch
+pm-wakeirq-fix-dedicated-wakeirq-for-drivers-not-using-autosuspend.patch
+genirq-affinity-fix-node-generation-from-cpumask.patch
+mmc-mmc_test-uninitialized-return-value.patch
+rpmsg-qcom_smd-correct-return-value-for-o_nonblock.patch
+mm-hugetlb.c-use-the-right-pte-val-for-compare-in-hugetlb_cow.patch
+docs-rst-fix-latex-durole-renewcommand-with-sphinx-1.3.patch
+mm-khugepaged-close-use-after-free-race-during-shmem-collapsing.patch
+mm-khugepaged-fix-radix-tree-node-leak-in-shmem-collapse-error-path.patch
+mm-compaction-fix-nr_isolated_-stats-for-pfn-based-migration.patch
+s390-crypto-unlock-on-error-in-prng_tdes_read.patch
+crypto-arm64-sha2-ce-fix-for-big-endian.patch
+crypto-arm64-ghash-ce-fix-for-big-endian.patch
+crypto-arm-aes-ce-fix-for-big-endian.patch
+crypto-arm64-aes-ccm-ce-fix-for-big-endian.patch
+crypto-arm64-aes-neon-fix-for-big-endian.patch
+crypto-arm64-sha1-ce-fix-for-big-endian.patch
+crypto-arm64-aes-xts-ce-fix-for-big-endian.patch
+crypto-arm64-aes-ce-fix-for-big-endian.patch
+md-md_recovery_needed-is-set-for-mddev-recovery.patch
+md-fix-refcount-problem-on-mddev-when-stopping-array.patch
+f2fs-remove-percpu_count-due-to-performance-regression.patch
+f2fs-hide-a-maybe-uninitialized-warning.patch
+staging-media-davinci_vpfe-unlock-on-error-in-vpfe_reqbufs.patch
+pci-rockchip-fix-negotiated-lanes-calculation.patch
+pci-rockchip-correct-the-use-of-fts-mask.patch
+pci-add-mellanox-device-ids.patch
+pci-convert-broken-intx-masking-quirks-from-header-to-final.patch
+pci-convert-mellanox-broken-intx-quirks-to-be-for-listed-devices-only.patch
+pci-support-intx-masking-on-connectx-4-with-firmware-x.14.1100.patch
+pci-enable-access-to-non-standard-vpd-for-chelsio-devices-cxgb3.patch
+powerpc-pci-rpadlpar-fix-device-reference-leaks.patch
+s390-topology-always-use-s390-specific-sched_domain_topology_level.patch
+s390-pci-fix-dma-address-calculation-in-map_sg.patch
--- /dev/null
+From c4a407b91f4b644145492e28723f9f880efb1da0 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 18 Nov 2016 09:30:24 -0200
+Subject: [media] staging: media: davinci_vpfe: unlock on error in vpfe_reqbufs()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit c4a407b91f4b644145492e28723f9f880efb1da0 upstream.
+
+We should unlock before returning this error code in vpfe_reqbufs().
+
+Fixes: 622897da67b3 ("[media] davinci: vpfe: add v4l2 video driver support")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/davinci_vpfe/vpfe_video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/media/davinci_vpfe/vpfe_video.c
++++ b/drivers/staging/media/davinci_vpfe/vpfe_video.c
+@@ -1362,7 +1362,7 @@ static int vpfe_reqbufs(struct file *fil
+ ret = vb2_queue_init(q);
+ if (ret) {
+ v4l2_err(&vpfe_dev->v4l2_dev, "vb2_queue_init() failed\n");
+- return ret;
++ goto unlock_out;
+ }
+
+ fh->io_allowed = 1;
--- /dev/null
+From a91918cd3ea11f91c68e08e1e8ce1b560447a80e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 13 Dec 2016 15:27:04 +0300
+Subject: target/iscsi: Fix double free in lio_target_tiqn_addtpg()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit a91918cd3ea11f91c68e08e1e8ce1b560447a80e upstream.
+
+This iscsit_tpg_add_portal_group() function is only called from
+lio_target_tiqn_addtpg(). Both functions free the "tpg" pointer on
+error so it's a double free bug. The memory is allocated in the caller
+so it should be freed in the caller and not here.
+
+Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+[ bvanassche: Added "Fix" at start of patch title ]
+Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/iscsi/iscsi_target_tpg.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/target/iscsi/iscsi_target_tpg.c
++++ b/drivers/target/iscsi/iscsi_target_tpg.c
+@@ -260,7 +260,6 @@ err_out:
+ iscsi_release_param_list(tpg->param_list);
+ tpg->param_list = NULL;
+ }
+- kfree(tpg);
+ return -ENOMEM;
+ }
+
--- /dev/null
+From 3df8d9208569ef0b2313e516566222d745f3b94b Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Thu, 15 Dec 2016 10:14:42 -0800
+Subject: x86/cpu: Probe CPUID leaf 6 even when cpuid_level == 6
+
+From: Andy Lutomirski <luto@kernel.org>
+
+commit 3df8d9208569ef0b2313e516566222d745f3b94b upstream.
+
+A typo (or mis-merge?) resulted in leaf 6 only being probed if
+cpuid_level >= 7.
+
+Fixes: 2ccd71f1b278 ("x86/cpufeature: Move some of the scattered feature bits to x86_capability")
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Acked-by: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Link: http://lkml.kernel.org/r/6ea30c0e9daec21e488b54761881a6dfcf3e04d0.1481825597.git.luto@kernel.org
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/common.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -667,13 +667,14 @@ void get_cpu_cap(struct cpuinfo_x86 *c)
+ c->x86_capability[CPUID_1_EDX] = edx;
+ }
+
++ /* Thermal and Power Management Leaf: level 0x00000006 (eax) */
++ if (c->cpuid_level >= 0x00000006)
++ c->x86_capability[CPUID_6_EAX] = cpuid_eax(0x00000006);
++
+ /* Additional Intel-defined flags: level 0x00000007 */
+ if (c->cpuid_level >= 0x00000007) {
+ cpuid_count(0x00000007, 0, &eax, &ebx, &ecx, &edx);
+-
+ c->x86_capability[CPUID_7_0_EBX] = ebx;
+-
+- c->x86_capability[CPUID_6_EAX] = cpuid_eax(0x00000006);
+ c->x86_capability[CPUID_7_ECX] = ecx;
+ }
+
--- /dev/null
+From a01aa6c9f40fe03c82032e7f8b3bcf1e6c93ac0e Mon Sep 17 00:00:00 2001
+From: Dmitry Safonov <dsafonov@virtuozzo.com>
+Date: Thu, 27 Oct 2016 17:15:15 +0300
+Subject: x86/prctl/uapi: Remove #ifdef for CHECKPOINT_RESTORE
+
+From: Dmitry Safonov <dsafonov@virtuozzo.com>
+
+commit a01aa6c9f40fe03c82032e7f8b3bcf1e6c93ac0e upstream.
+
+As userspace knows nothing about kernel config, thus #ifdefs
+around ABI prctl constants makes them invisible to userspace.
+
+Let it be clean'n'simple: remove #ifdefs.
+
+If kernel has CONFIG_CHECKPOINT_RESTORE disabled, sys_prctl()
+will return -EINVAL for those prctls.
+
+Reported-by: Paul Bolle <pebolle@tiscali.nl>
+Signed-off-by: Dmitry Safonov <dsafonov@virtuozzo.com>
+Acked-by: Andy Lutomirski <luto@kernel.org>
+Cc: 0x7f454c46@gmail.com
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: Cyrill Gorcunov <gorcunov@openvz.org>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-mm@kvack.org
+Cc: oleg@redhat.com
+Fixes: 2eefd8789698 ("x86/arch_prctl/vdso: Add ARCH_MAP_VDSO_*")
+Link: http://lkml.kernel.org/r/20161027141516.28447-2-dsafonov@virtuozzo.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/include/uapi/asm/prctl.h | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/include/uapi/asm/prctl.h
++++ b/arch/x86/include/uapi/asm/prctl.h
+@@ -6,10 +6,8 @@
+ #define ARCH_GET_FS 0x1003
+ #define ARCH_GET_GS 0x1004
+
+-#ifdef CONFIG_CHECKPOINT_RESTORE
+-# define ARCH_MAP_VDSO_X32 0x2001
+-# define ARCH_MAP_VDSO_32 0x2002
+-# define ARCH_MAP_VDSO_64 0x2003
+-#endif
++#define ARCH_MAP_VDSO_X32 0x2001
++#define ARCH_MAP_VDSO_32 0x2002
++#define ARCH_MAP_VDSO_64 0x2003
+
+ #endif /* _ASM_X86_PRCTL_H */
projects / thirdparty / kernel / stable-queue.git / commitdiff
