--- /dev/null
+From 922cc171998ac3dbe74d57011ef7ed57e9b0d7df Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Mon, 31 Oct 2016 14:09:52 -0700
+Subject: ARC: timer: rtc: implement read loop in "C" vs. inline asm
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit 922cc171998ac3dbe74d57011ef7ed57e9b0d7df upstream.
+
+The current code doesn't even compile as somehow the inline assembly
+can't see the register names defined as ARC_RTC_*
+I'm pretty sure It worked when I first got it merged, but the tools were
+definitely different then.
+
+So better to write this in "C" anyways.
+
+Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/kernel/time.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/arch/arc/kernel/time.c
++++ b/arch/arc/kernel/time.c
+@@ -130,14 +130,17 @@ static cycle_t arc_counter_read(struct c
+ cycle_t full;
+ } stamp;
+
+-
+- __asm__ __volatile(
+- "1: \n"
+- " lr %0, [AUX_RTC_LOW] \n"
+- " lr %1, [AUX_RTC_HIGH] \n"
+- " lr %2, [AUX_RTC_CTRL] \n"
+- " bbit0.nt %2, 31, 1b \n"
+- : "=r" (stamp.low), "=r" (stamp.high), "=r" (status));
++ /*
++ * hardware has an internal state machine which tracks readout of
++ * low/high and updates the CTRL.status if
++ * - interrupt/exception taken between the two reads
++ * - high increments after low has been read
++ */
++ do {
++ stamp.low = read_aux_reg(AUX_RTC_LOW);
++ stamp.high = read_aux_reg(AUX_RTC_HIGH);
++ status = read_aux_reg(AUX_RTC_CTRL);
++ } while (!(status & _BITUL(31)));
+
+ return stamp.full;
+ }
--- /dev/null
+From 7c1c5413a7bdf1c9adc8d979521f1b8286366aef Mon Sep 17 00:00:00 2001
+From: Scott Wood <oss@buserror.net>
+Date: Mon, 17 Oct 2016 13:42:23 -0500
+Subject: clk: qoriq: Don't allow CPU clocks higher than starting value
+
+From: Scott Wood <oss@buserror.net>
+
+commit 7c1c5413a7bdf1c9adc8d979521f1b8286366aef upstream.
+
+The boot-time frequency of a CPU is considered its rated maximum, as we
+have no other source of such information. However, this was previously
+only used for chips with 80% restrictions on secondary PLLs. This
+usually wasn't a problem because most chips/configs boot with a divider
+of /1, with other dividers being used only for dynamic frequency
+reduction. However, at least one config (LS1021A at less than 1 GHz)
+uses a different divider for top speed. This was causing cpufreq to set
+a frequency beyond the chip's rated speed.
+
+This is fixed by applying a 100%-of-initial-speed limit to all CPU PLLs,
+similar to the existing 80% limit that only applied to some.
+
+Signed-off-by: Scott Wood <oss@buserror.net>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk-qoriq.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -700,6 +700,7 @@ static struct clk * __init create_mux_co
+ struct mux_hwclock *hwc,
+ const struct clk_ops *ops,
+ unsigned long min_rate,
++ unsigned long max_rate,
+ unsigned long pct80_rate,
+ const char *fmt, int idx)
+ {
+@@ -728,6 +729,8 @@ static struct clk * __init create_mux_co
+ continue;
+ if (rate < min_rate)
+ continue;
++ if (rate > max_rate)
++ continue;
+
+ parent_names[j] = div->name;
+ hwc->parent_to_clksel[j] = i;
+@@ -759,7 +762,7 @@ static struct clk * __init create_one_cm
+ struct mux_hwclock *hwc;
+ const struct clockgen_pll_div *div;
+ unsigned long plat_rate, min_rate;
+- u64 pct80_rate;
++ u64 max_rate, pct80_rate;
+ u32 clksel;
+
+ hwc = kzalloc(sizeof(*hwc), GFP_KERNEL);
+@@ -787,8 +790,8 @@ static struct clk * __init create_one_cm
+ return NULL;
+ }
+
+- pct80_rate = clk_get_rate(div->clk);
+- pct80_rate *= 8;
++ max_rate = clk_get_rate(div->clk);
++ pct80_rate = max_rate * 8;
+ do_div(pct80_rate, 10);
+
+ plat_rate = clk_get_rate(cg->pll[PLATFORM_PLL].div[PLL_DIV1].clk);
+@@ -798,7 +801,7 @@ static struct clk * __init create_one_cm
+ else
+ min_rate = plat_rate / 2;
+
+- return create_mux_common(cg, hwc, &cmux_ops, min_rate,
++ return create_mux_common(cg, hwc, &cmux_ops, min_rate, max_rate,
+ pct80_rate, "cg-cmux%d", idx);
+ }
+
+@@ -813,7 +816,7 @@ static struct clk * __init create_one_hw
+ hwc->reg = cg->regs + 0x20 * idx + 0x10;
+ hwc->info = cg->info.hwaccel[idx];
+
+- return create_mux_common(cg, hwc, &hwaccel_ops, 0, 0,
++ return create_mux_common(cg, hwc, &hwaccel_ops, 0, ULONG_MAX, 0,
+ "cg-hwaccel%d", idx);
+ }
+
--- /dev/null
+From 70d78fe7c8b640b5acfad56ad341985b3810998a Mon Sep 17 00:00:00 2001
+From: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Date: Thu, 10 Nov 2016 10:46:38 -0800
+Subject: coredump: fix unfreezable coredumping task
+
+From: Andrey Ryabinin <aryabinin@virtuozzo.com>
+
+commit 70d78fe7c8b640b5acfad56ad341985b3810998a upstream.
+
+It could be not possible to freeze coredumping task when it waits for
+'core_state->startup' completion, because threads are frozen in
+get_signal() before they got a chance to complete 'core_state->startup'.
+
+Inability to freeze a task during suspend will cause suspend to fail.
+Also CRIU uses cgroup freezer during dump operation. So with an
+unfreezable task the CRIU dump will fail because it waits for a
+transition from 'FREEZING' to 'FROZEN' state which will never happen.
+
+Use freezer_do_not_count() to tell freezer to ignore coredumping task
+while it waits for core_state->startup completion.
+
+Link: http://lkml.kernel.org/r/1475225434-3753-1-git-send-email-aryabinin@virtuozzo.com
+Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Cc: Alexander Viro <viro@zeniv.linux.org.uk>
+Cc: Tejun Heo <tj@kernel.org>
+Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
+Cc: Michal Hocko <mhocko@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/coredump.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -1,6 +1,7 @@
+ #include <linux/slab.h>
+ #include <linux/file.h>
+ #include <linux/fdtable.h>
++#include <linux/freezer.h>
+ #include <linux/mm.h>
+ #include <linux/stat.h>
+ #include <linux/fcntl.h>
+@@ -399,7 +400,9 @@ static int coredump_wait(int exit_code,
+ if (core_waiters > 0) {
+ struct core_thread *ptr;
+
++ freezer_do_not_count();
+ wait_for_completion(&core_state->startup);
++ freezer_count();
+ /*
+ * Wait for all the threads to become inactive, so that
+ * all the thread context (extended register state, like
--- /dev/null
+From d8e9e5e80e882b4f90cba7edf1e6cb7376e52e54 Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Wed, 9 Nov 2016 22:52:58 +0100
+Subject: drbd: Fix kernel_sendmsg() usage - potential NULL deref
+
+From: Richard Weinberger <richard@nod.at>
+
+commit d8e9e5e80e882b4f90cba7edf1e6cb7376e52e54 upstream.
+
+Don't pass a size larger than iov_len to kernel_sendmsg().
+Otherwise it will cause a NULL pointer deref when kernel_sendmsg()
+returns with rv < size.
+
+DRBD as external module has been around in the kernel 2.4 days already.
+We used to be compatible to 2.4 and very early 2.6 kernels,
+we used to use
+ rv = sock_sendmsg(sock, &msg, iov.iov_len);
+then later changed to
+ rv = kernel_sendmsg(sock, &msg, &iov, 1, size);
+when we should have used
+ rv = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
+
+tcp_sendmsg() used to totally ignore the size parameter.
+ 57be5bd ip: convert tcp_sendmsg() to iov_iter primitives
+changes that, and exposes our long standing error.
+
+Even with this error exposed, to trigger the bug, we would need to have
+an environment (config or otherwise) causing us to not use sendpage()
+for larger transfers, a failing connection, and have it fail "just at the
+right time". Apparently that was unlikely enough for most, so this went
+unnoticed for years.
+
+Still, it is known to trigger at least some of these,
+and suspected for the others:
+[0] http://lists.linbit.com/pipermail/drbd-user/2016-July/023112.html
+[1] http://lists.linbit.com/pipermail/drbd-dev/2016-March/003362.html
+[2] https://forums.grsecurity.net/viewtopic.php?f=3&t=4546
+[3] https://ubuntuforums.org/showthread.php?t=2336150
+[4] http://e2.howsolveproblem.com/i/1175162/
+
+This should go into 4.9,
+and into all stable branches since and including v4.0,
+which is the first to contain the exposing change.
+
+It is correct for all stable branches older than that as well
+(which contain the DRBD driver; which is 2.6.33 and up).
+
+It requires a small "conflict" resolution for v4.4 and earlier, with v4.5
+we dropped the comment block immediately preceding the kernel_sendmsg().
+
+Fixes: b411b3637fa7 ("The DRBD driver")
+Cc: viro@zeniv.linux.org.uk
+Cc: christoph.lechleitner@iteg.at
+Cc: wolfgang.glas@iteg.at
+Reported-by: Christoph Lechleitner <christoph.lechleitner@iteg.at>
+Tested-by: Christoph Lechleitner <christoph.lechleitner@iteg.at>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+[changed oneliner to be "obvious" without context; more verbose message]
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/drbd/drbd_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -1802,7 +1802,7 @@ int drbd_send(struct drbd_connection *co
+ * do we need to block DRBD_SIG if sock == &meta.socket ??
+ * otherwise wake_asender() might interrupt some send_*Ack !
+ */
+- rv = kernel_sendmsg(sock, &msg, &iov, 1, size);
++ rv = kernel_sendmsg(sock, &msg, &iov, 1, iov.iov_len);
+ if (rv == -EAGAIN) {
+ if (we_should_drop_the_connection(connection, sock))
+ break;
--- /dev/null
+From d8f8a74d5fece355d2234e1731231d1aebc66b38 Mon Sep 17 00:00:00 2001
+From: Paul Fertser <fercerpav@gmail.com>
+Date: Thu, 27 Oct 2016 17:22:08 +0300
+Subject: drivers: staging: nvec: remove bogus reset command for PS/2 interface
+
+From: Paul Fertser <fercerpav@gmail.com>
+
+commit d8f8a74d5fece355d2234e1731231d1aebc66b38 upstream.
+
+This command was sent behind serio's back and the answer to it was
+confusing atkbd probe function which lead to the elantech touchpad
+getting detected as a keyboard.
+
+To prevent this from happening just let every party do its part of the
+job.
+
+Signed-off-by: Paul Fertser <fercerpav@gmail.com>
+Acked-by: Marc Dietrich <marvin24@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/nvec/nvec_ps2.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/staging/nvec/nvec_ps2.c
++++ b/drivers/staging/nvec/nvec_ps2.c
+@@ -106,7 +106,6 @@ static int nvec_mouse_probe(struct platf
+ {
+ struct nvec_chip *nvec = dev_get_drvdata(pdev->dev.parent);
+ struct serio *ser_dev;
+- char mouse_reset[] = { NVEC_PS2, SEND_COMMAND, PSMOUSE_RST, 3 };
+
+ ser_dev = devm_kzalloc(&pdev->dev, sizeof(struct serio), GFP_KERNEL);
+ if (!ser_dev)
+@@ -127,9 +126,6 @@ static int nvec_mouse_probe(struct platf
+
+ serio_register_port(ser_dev);
+
+- /* mouse reset */
+- nvec_write_async(nvec, mouse_reset, sizeof(mouse_reset));
+-
+ return 0;
+ }
+
--- /dev/null
+From 84b1528e8cef55274f0df20e93513b3060ce495a Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 31 Oct 2016 11:02:31 -0400
+Subject: drm/amdgpu: disable runtime pm in certain cases
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 84b1528e8cef55274f0df20e93513b3060ce495a upstream.
+
+If the platform does not support hybrid graphics or ATPX dGPU
+power control.
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -96,6 +96,8 @@ int amdgpu_driver_load_kms(struct drm_de
+
+ if ((amdgpu_runtime_pm != 0) &&
+ amdgpu_has_atpx() &&
++ (amdgpu_is_atpx_hybrid() ||
++ amdgpu_has_atpx_dgpu_power_cntl()) &&
+ ((flags & AMD_IS_APU) == 0))
+ flags |= AMD_IS_PX;
+
--- /dev/null
+From 8d83bc22b259e5526625b6d298f637786c71129f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Tue, 11 Oct 2016 20:52:46 +0300
+Subject: drm/i915: Respect alternate_ddc_pin for all DDI ports
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 8d83bc22b259e5526625b6d298f637786c71129f upstream.
+
+The VBT provides the platform a way to mix and match the DDI ports vs.
+GMBUS pins. Currently we only trust the VBT for DDI E, which I suppose
+has no standard GMBUS pin assignment. However, there are machines out
+there that use a non-standard mapping for the other ports as well.
+Let's start trusting the VBT on this one for all ports on DDI platforms.
+
+I've structured the code such that other platforms could easily start
+using this as well, by simply filling in the ddi_port_info. IIRC there
+may be CHV system that might actually need this.
+
+v2: Include a commit message, include a debug message during init
+
+Cc: Maarten Maathuis <madman2003@gmail.com>
+Tested-by: Maarten Maathuis <madman2003@gmail.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97877
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1476208368-5710-3-git-send-email-ville.syrjala@linux.intel.com
+Reviewed-by: Jim Bride <jim.bride@linux.intel.com>
+(cherry picked from commit e4ab73a13291fc844c9e24d5c347bd95818544d2)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_hdmi.c | 84 +++++++++++++++++++++-----------------
+ 1 file changed, 48 insertions(+), 36 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -1997,6 +1997,50 @@ intel_hdmi_add_properties(struct intel_h
+ intel_hdmi->aspect_ratio = HDMI_PICTURE_ASPECT_NONE;
+ }
+
++static u8 intel_hdmi_ddc_pin(struct drm_i915_private *dev_priv,
++ enum port port)
++{
++ const struct ddi_vbt_port_info *info =
++ &dev_priv->vbt.ddi_port_info[port];
++ u8 ddc_pin;
++
++ if (info->alternate_ddc_pin) {
++ DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (VBT)\n",
++ info->alternate_ddc_pin, port_name(port));
++ return info->alternate_ddc_pin;
++ }
++
++ switch (port) {
++ case PORT_B:
++ if (IS_BROXTON(dev_priv))
++ ddc_pin = GMBUS_PIN_1_BXT;
++ else
++ ddc_pin = GMBUS_PIN_DPB;
++ break;
++ case PORT_C:
++ if (IS_BROXTON(dev_priv))
++ ddc_pin = GMBUS_PIN_2_BXT;
++ else
++ ddc_pin = GMBUS_PIN_DPC;
++ break;
++ case PORT_D:
++ if (IS_CHERRYVIEW(dev_priv))
++ ddc_pin = GMBUS_PIN_DPD_CHV;
++ else
++ ddc_pin = GMBUS_PIN_DPD;
++ break;
++ default:
++ MISSING_CASE(port);
++ ddc_pin = GMBUS_PIN_DPB;
++ break;
++ }
++
++ DRM_DEBUG_KMS("Using DDC pin 0x%x for port %c (platform default)\n",
++ ddc_pin, port_name(port));
++
++ return ddc_pin;
++}
++
+ void intel_hdmi_init_connector(struct intel_digital_port *intel_dig_port,
+ struct intel_connector *intel_connector)
+ {
+@@ -2006,7 +2050,6 @@ void intel_hdmi_init_connector(struct in
+ struct drm_device *dev = intel_encoder->base.dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ enum port port = intel_dig_port->port;
+- uint8_t alternate_ddc_pin;
+
+ DRM_DEBUG_KMS("Adding HDMI connector on port %c\n",
+ port_name(port));
+@@ -2019,12 +2062,10 @@ void intel_hdmi_init_connector(struct in
+ connector->doublescan_allowed = 0;
+ connector->stereo_allowed = 1;
+
++ intel_hdmi->ddc_bus = intel_hdmi_ddc_pin(dev_priv, port);
++
+ switch (port) {
+ case PORT_B:
+- if (IS_BROXTON(dev_priv))
+- intel_hdmi->ddc_bus = GMBUS_PIN_1_BXT;
+- else
+- intel_hdmi->ddc_bus = GMBUS_PIN_DPB;
+ /*
+ * On BXT A0/A1, sw needs to activate DDIA HPD logic and
+ * interrupts to check the external panel connection.
+@@ -2035,46 +2076,17 @@ void intel_hdmi_init_connector(struct in
+ intel_encoder->hpd_pin = HPD_PORT_B;
+ break;
+ case PORT_C:
+- if (IS_BROXTON(dev_priv))
+- intel_hdmi->ddc_bus = GMBUS_PIN_2_BXT;
+- else
+- intel_hdmi->ddc_bus = GMBUS_PIN_DPC;
+ intel_encoder->hpd_pin = HPD_PORT_C;
+ break;
+ case PORT_D:
+- if (WARN_ON(IS_BROXTON(dev_priv)))
+- intel_hdmi->ddc_bus = GMBUS_PIN_DISABLED;
+- else if (IS_CHERRYVIEW(dev_priv))
+- intel_hdmi->ddc_bus = GMBUS_PIN_DPD_CHV;
+- else
+- intel_hdmi->ddc_bus = GMBUS_PIN_DPD;
+ intel_encoder->hpd_pin = HPD_PORT_D;
+ break;
+ case PORT_E:
+- /* On SKL PORT E doesn't have seperate GMBUS pin
+- * We rely on VBT to set a proper alternate GMBUS pin. */
+- alternate_ddc_pin =
+- dev_priv->vbt.ddi_port_info[PORT_E].alternate_ddc_pin;
+- switch (alternate_ddc_pin) {
+- case DDC_PIN_B:
+- intel_hdmi->ddc_bus = GMBUS_PIN_DPB;
+- break;
+- case DDC_PIN_C:
+- intel_hdmi->ddc_bus = GMBUS_PIN_DPC;
+- break;
+- case DDC_PIN_D:
+- intel_hdmi->ddc_bus = GMBUS_PIN_DPD;
+- break;
+- default:
+- MISSING_CASE(alternate_ddc_pin);
+- }
+ intel_encoder->hpd_pin = HPD_PORT_E;
+ break;
+- case PORT_A:
+- intel_encoder->hpd_pin = HPD_PORT_A;
+- /* Internal port only for eDP. */
+ default:
+- BUG();
++ MISSING_CASE(port);
++ return;
+ }
+
+ if (IS_VALLEYVIEW(dev)) {
--- /dev/null
+From 066f1f0b4719eb4573ef09bfc63c2bbb6f7676ca Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 31 Oct 2016 10:41:49 -0400
+Subject: drm/radeon: disable runtime pm in certain cases
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 066f1f0b4719eb4573ef09bfc63c2bbb6f7676ca upstream.
+
+If the platform does not support hybrid graphics or ATPX dGPU
+power control.
+
+bug: https://bugzilla.kernel.org/show_bug.cgi?id=51381
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_device.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_device.c
++++ b/drivers/gpu/drm/radeon/radeon_device.c
+@@ -103,6 +103,14 @@ static const char radeon_family_name[][1
+ "LAST",
+ };
+
++#if defined(CONFIG_VGA_SWITCHEROO)
++bool radeon_has_atpx_dgpu_power_cntl(void);
++bool radeon_is_atpx_hybrid(void);
++#else
++static inline bool radeon_has_atpx_dgpu_power_cntl(void) { return false; }
++static inline bool radeon_is_atpx_hybrid(void) { return false; }
++#endif
++
+ #define RADEON_PX_QUIRK_DISABLE_PX (1 << 0)
+ #define RADEON_PX_QUIRK_LONG_WAKEUP (1 << 1)
+
+@@ -159,6 +167,11 @@ static void radeon_device_handle_px_quir
+
+ if (rdev->px_quirk_flags & RADEON_PX_QUIRK_DISABLE_PX)
+ rdev->flags &= ~RADEON_IS_PX;
++
++ /* disable PX is the system doesn't support dGPU power control or hybrid gfx */
++ if (!radeon_is_atpx_hybrid() &&
++ !radeon_has_atpx_dgpu_power_cntl())
++ rdev->flags &= ~RADEON_IS_PX;
+ }
+
+ /**
--- /dev/null
+From 6f77199e9e4b84340c751c585691d7642a47d226 Mon Sep 17 00:00:00 2001
+From: Song Hongyan <hongyan.song@intel.com>
+Date: Tue, 25 Oct 2016 01:30:07 +0000
+Subject: iio: hid-sensors: Increase the precision of scale to fix wrong reading interpretation.
+
+From: Song Hongyan <hongyan.song@intel.com>
+
+commit 6f77199e9e4b84340c751c585691d7642a47d226 upstream.
+
+While testing, it was observed that on some platforms the scale value
+from iio sysfs for gyroscope is always 0 (E.g. Yoga 260). This results
+in the final angular velocity component values to be zeros.
+
+This is caused by insufficient precision of scale value displayed in sysfs.
+If the precision is changed to nano from current micro, then this is
+sufficient to display the scale value on this platform.
+Since this can be a problem for all other HID sensors, increase scale
+precision of all HID sensors to nano from current micro.
+
+Results on Yoga 260:
+
+name scale before scale now
+--------------------------------------------
+gyro_3d 0.000000 0.000000174
+als 0.001000 0.001000000
+magn_3d 0.000001 0.000001000
+accel_3d 0.000009 0.000009806
+
+Signed-off-by: Song Hongyan <hongyan.song@intel.com>
+Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/common/hid-sensors/hid-sensor-attributes.c | 56 ++++++++---------
+ 1 file changed, 28 insertions(+), 28 deletions(-)
+
+--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
++++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+@@ -30,26 +30,26 @@ static struct {
+ u32 usage_id;
+ int unit; /* 0 for default others from HID sensor spec */
+ int scale_val0; /* scale, whole number */
+- int scale_val1; /* scale, fraction in micros */
++ int scale_val1; /* scale, fraction in nanos */
+ } unit_conversion[] = {
+- {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650},
++ {HID_USAGE_SENSOR_ACCEL_3D, 0, 9, 806650000},
+ {HID_USAGE_SENSOR_ACCEL_3D,
+ HID_USAGE_SENSOR_UNITS_METERS_PER_SEC_SQRD, 1, 0},
+ {HID_USAGE_SENSOR_ACCEL_3D,
+- HID_USAGE_SENSOR_UNITS_G, 9, 806650},
++ HID_USAGE_SENSOR_UNITS_G, 9, 806650000},
+
+- {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453},
++ {HID_USAGE_SENSOR_GYRO_3D, 0, 0, 17453293},
+ {HID_USAGE_SENSOR_GYRO_3D,
+ HID_USAGE_SENSOR_UNITS_RADIANS_PER_SECOND, 1, 0},
+ {HID_USAGE_SENSOR_GYRO_3D,
+- HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453},
++ HID_USAGE_SENSOR_UNITS_DEGREES_PER_SECOND, 0, 17453293},
+
+- {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000},
++ {HID_USAGE_SENSOR_COMPASS_3D, 0, 0, 1000000},
+ {HID_USAGE_SENSOR_COMPASS_3D, HID_USAGE_SENSOR_UNITS_GAUSS, 1, 0},
+
+- {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453},
++ {HID_USAGE_SENSOR_INCLINOMETER_3D, 0, 0, 17453293},
+ {HID_USAGE_SENSOR_INCLINOMETER_3D,
+- HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453},
++ HID_USAGE_SENSOR_UNITS_DEGREES, 0, 17453293},
+ {HID_USAGE_SENSOR_INCLINOMETER_3D,
+ HID_USAGE_SENSOR_UNITS_RADIANS, 1, 0},
+
+@@ -57,7 +57,7 @@ static struct {
+ {HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0},
+
+ {HID_USAGE_SENSOR_PRESSURE, 0, 100, 0},
+- {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000},
++ {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000000},
+ };
+
+ static int pow_10(unsigned power)
+@@ -266,15 +266,15 @@ EXPORT_SYMBOL(hid_sensor_write_raw_hyst_
+ /*
+ * This fuction applies the unit exponent to the scale.
+ * For example:
+- * 9.806650 ->exp:2-> val0[980]val1[665000]
+- * 9.000806 ->exp:2-> val0[900]val1[80600]
+- * 0.174535 ->exp:2-> val0[17]val1[453500]
+- * 1.001745 ->exp:0-> val0[1]val1[1745]
+- * 1.001745 ->exp:2-> val0[100]val1[174500]
+- * 1.001745 ->exp:4-> val0[10017]val1[450000]
+- * 9.806650 ->exp:-2-> val0[0]val1[98066]
++ * 9.806650000 ->exp:2-> val0[980]val1[665000000]
++ * 9.000806000 ->exp:2-> val0[900]val1[80600000]
++ * 0.174535293 ->exp:2-> val0[17]val1[453529300]
++ * 1.001745329 ->exp:0-> val0[1]val1[1745329]
++ * 1.001745329 ->exp:2-> val0[100]val1[174532900]
++ * 1.001745329 ->exp:4-> val0[10017]val1[453290000]
++ * 9.806650000 ->exp:-2-> val0[0]val1[98066500]
+ */
+-static void adjust_exponent_micro(int *val0, int *val1, int scale0,
++static void adjust_exponent_nano(int *val0, int *val1, int scale0,
+ int scale1, int exp)
+ {
+ int i;
+@@ -285,32 +285,32 @@ static void adjust_exponent_micro(int *v
+ if (exp > 0) {
+ *val0 = scale0 * pow_10(exp);
+ res = 0;
+- if (exp > 6) {
++ if (exp > 9) {
+ *val1 = 0;
+ return;
+ }
+ for (i = 0; i < exp; ++i) {
+- x = scale1 / pow_10(5 - i);
++ x = scale1 / pow_10(8 - i);
+ res += (pow_10(exp - 1 - i) * x);
+- scale1 = scale1 % pow_10(5 - i);
++ scale1 = scale1 % pow_10(8 - i);
+ }
+ *val0 += res;
+ *val1 = scale1 * pow_10(exp);
+ } else if (exp < 0) {
+ exp = abs(exp);
+- if (exp > 6) {
++ if (exp > 9) {
+ *val0 = *val1 = 0;
+ return;
+ }
+ *val0 = scale0 / pow_10(exp);
+ rem = scale0 % pow_10(exp);
+ res = 0;
+- for (i = 0; i < (6 - exp); ++i) {
+- x = scale1 / pow_10(5 - i);
+- res += (pow_10(5 - exp - i) * x);
+- scale1 = scale1 % pow_10(5 - i);
++ for (i = 0; i < (9 - exp); ++i) {
++ x = scale1 / pow_10(8 - i);
++ res += (pow_10(8 - exp - i) * x);
++ scale1 = scale1 % pow_10(8 - i);
+ }
+- *val1 = rem * pow_10(6 - exp) + res;
++ *val1 = rem * pow_10(9 - exp) + res;
+ } else {
+ *val0 = scale0;
+ *val1 = scale1;
+@@ -332,14 +332,14 @@ int hid_sensor_format_scale(u32 usage_id
+ unit_conversion[i].unit == attr_info->units) {
+ exp = hid_sensor_convert_exponent(
+ attr_info->unit_expo);
+- adjust_exponent_micro(val0, val1,
++ adjust_exponent_nano(val0, val1,
+ unit_conversion[i].scale_val0,
+ unit_conversion[i].scale_val1, exp);
+ break;
+ }
+ }
+
+- return IIO_VAL_INT_PLUS_MICRO;
++ return IIO_VAL_INT_PLUS_NANO;
+ }
+ EXPORT_SYMBOL(hid_sensor_format_scale);
+
--- /dev/null
+From 8af644a7d6846f48d6b72be5d4a3c6eb16bd33c8 Mon Sep 17 00:00:00 2001
+From: Song Hongyan <hongyan.song@intel.com>
+Date: Tue, 25 Oct 2016 01:06:03 +0000
+Subject: iio: orientation: hid-sensor-rotation: Add PM function (fix non working driver)
+
+From: Song Hongyan <hongyan.song@intel.com>
+
+commit 8af644a7d6846f48d6b72be5d4a3c6eb16bd33c8 upstream.
+
+This fix makes newer ISH hubs work. Previous ones worked by lucky
+coincidence.
+
+Rotation sensor function does not work due to miss PM function.
+Add common hid sensor iio pm function for rotation sensor.
+
+Further clarification from Srinivas:
+
+If CONFIG_PM is not defined, then this prevents this sensor to
+function. So above commit caused this.
+
+This sensor was supposed to be always on to trigger wake up in prior
+external hubs. But with the new ISH hub this is not the case.
+
+Signed-off-by: Song Hongyan <hongyan.song@intel.com>
+Fixes: 2b89635e9a9e ("iio: hid_sensor_hub: Common PM functions")
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/orientation/hid-sensor-rotation.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/orientation/hid-sensor-rotation.c
++++ b/drivers/iio/orientation/hid-sensor-rotation.c
+@@ -335,6 +335,7 @@ static struct platform_driver hid_dev_ro
+ .id_table = hid_dev_rot_ids,
+ .driver = {
+ .name = KBUILD_MODNAME,
++ .pm = &hid_sensor_pm_ops,
+ },
+ .probe = hid_dev_rot_probe,
+ .remove = hid_dev_rot_remove,
--- /dev/null
+From e1e575f6b026734be3b1f075e780e91ab08ca541 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Tue, 25 Oct 2016 16:11:12 +0100
+Subject: KVM: MIPS: Precalculate MMIO load resume PC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit e1e575f6b026734be3b1f075e780e91ab08ca541 upstream.
+
+The advancing of the PC when completing an MMIO load is done before
+re-entering the guest, i.e. before restoring the guest ASID. However if
+the load is in a branch delay slot it may need to access guest code to
+read the prior branch instruction. This isn't safe in TLB mapped code at
+the moment, nor in the future when we'll access unmapped guest segments
+using direct user accessors too, as it could read the branch from host
+user memory instead.
+
+Therefore calculate the resume PC in advance while we're still in the
+right context and save it in the new vcpu->arch.io_pc (replacing the no
+longer needed vcpu->arch.pending_load_cause), and restore it on MMIO
+completion.
+
+Fixes: e685c689f3a8 ("KVM/MIPS32: Privileged instruction/target branch emulation.")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: "Radim Krčmář <rkrcmar@redhat.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: kvm@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+[james.hogan@imgtec.com: Backport to 3.18..4.4]
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/include/asm/kvm_host.h | 7 ++++---
+ arch/mips/kvm/emulate.c | 24 +++++++++++++++---------
+ 2 files changed, 19 insertions(+), 12 deletions(-)
+
+--- a/arch/mips/include/asm/kvm_host.h
++++ b/arch/mips/include/asm/kvm_host.h
+@@ -400,7 +400,10 @@ struct kvm_vcpu_arch {
+ /* Host KSEG0 address of the EI/DI offset */
+ void *kseg0_commpage;
+
+- u32 io_gpr; /* GPR used as IO source/target */
++ /* Resume PC after MMIO completion */
++ unsigned long io_pc;
++ /* GPR used as IO source/target */
++ u32 io_gpr;
+
+ struct hrtimer comparecount_timer;
+ /* Count timer control KVM register */
+@@ -422,8 +425,6 @@ struct kvm_vcpu_arch {
+ /* Bitmask of pending exceptions to be cleared */
+ unsigned long pending_exceptions_clr;
+
+- unsigned long pending_load_cause;
+-
+ /* Save/Restore the entryhi register when are are preempted/scheduled back in */
+ unsigned long preempt_entryhi;
+
+--- a/arch/mips/kvm/emulate.c
++++ b/arch/mips/kvm/emulate.c
+@@ -1473,6 +1473,7 @@ enum emulation_result kvm_mips_emulate_l
+ struct kvm_vcpu *vcpu)
+ {
+ enum emulation_result er = EMULATE_DO_MMIO;
++ unsigned long curr_pc;
+ int32_t op, base, rt, offset;
+ uint32_t bytes;
+
+@@ -1481,7 +1482,18 @@ enum emulation_result kvm_mips_emulate_l
+ offset = inst & 0xffff;
+ op = (inst >> 26) & 0x3f;
+
+- vcpu->arch.pending_load_cause = cause;
++ /*
++ * Find the resume PC now while we have safe and easy access to the
++ * prior branch instruction, and save it for
++ * kvm_mips_complete_mmio_load() to restore later.
++ */
++ curr_pc = vcpu->arch.pc;
++ er = update_pc(vcpu, cause);
++ if (er == EMULATE_FAIL)
++ return er;
++ vcpu->arch.io_pc = vcpu->arch.pc;
++ vcpu->arch.pc = curr_pc;
++
+ vcpu->arch.io_gpr = rt;
+
+ switch (op) {
+@@ -2461,9 +2473,8 @@ enum emulation_result kvm_mips_complete_
+ goto done;
+ }
+
+- er = update_pc(vcpu, vcpu->arch.pending_load_cause);
+- if (er == EMULATE_FAIL)
+- return er;
++ /* Restore saved resume PC */
++ vcpu->arch.pc = vcpu->arch.io_pc;
+
+ switch (run->mmio.len) {
+ case 4:
+@@ -2485,11 +2496,6 @@ enum emulation_result kvm_mips_complete_
+ break;
+ }
+
+- if (vcpu->arch.pending_load_cause & CAUSEF_BD)
+- kvm_debug("[%#lx] Completing %d byte BD Load to gpr %d (0x%08lx) type %d\n",
+- vcpu->arch.pc, run->mmio.len, vcpu->arch.io_gpr, *gpr,
+- vcpu->mmio_needed);
+-
+ done:
+ return er;
+ }
--- /dev/null
+From d2cdf5dc58f6970e9d9d26e47974c21fe87983f3 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Mon, 31 Oct 2016 16:57:33 +0200
+Subject: pinctrl: cherryview: Prevent possible interrupt storm on resume
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit d2cdf5dc58f6970e9d9d26e47974c21fe87983f3 upstream.
+
+When the system is suspended to S3 the BIOS might re-initialize certain
+GPIO pins back to their original state or it may re-program interrupt mask
+of others. For example Acer TravelMate B116-M had BIOS bug where certain
+GPIO pin (MF_ISH_GPIO_5) was programmed to trigger on high level, and the
+pin state was high once the BIOS gave control to the OS on resume.
+
+This triggers lots of messages like:
+
+ irq 117, desc: ffff88017a61e600, depth: 1, count: 0, unhandled: 0
+ ->handle_irq(): ffffffff8109b613, handle_bad_irq+0x0/0x1e0
+ ->irq_data.chip(): ffffffffa0020180, chv_pinctrl_exit+0x2d84/0x12 [pinctrl_cherryview]
+ ->action(): (null)
+ IRQ_NOPROBE set
+
+We reset the mask back to known state in chv_pinctrl_resume() but that is
+called only after device interrupts have already been enabled.
+
+Now, this particular issue was fixed by upgrading the BIOS to the latest
+(v1.23) but not everybody upgrades their BIOSes so we fix it up in the
+driver as well.
+
+Prevent the possible interrupt storm by moving suspend and resume hooks to
+be called at _noirq time instead. Since device interrupts are still
+disabled we can restore the mask back to known state before interrupt storm
+happens.
+
+Reported-by: Christian Steiner <christian.steiner@outlook.de>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1564,7 +1564,7 @@ static int chv_pinctrl_remove(struct pla
+ }
+
+ #ifdef CONFIG_PM_SLEEP
+-static int chv_pinctrl_suspend(struct device *dev)
++static int chv_pinctrl_suspend_noirq(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct chv_pinctrl *pctrl = platform_get_drvdata(pdev);
+@@ -1598,7 +1598,7 @@ static int chv_pinctrl_suspend(struct de
+ return 0;
+ }
+
+-static int chv_pinctrl_resume(struct device *dev)
++static int chv_pinctrl_resume_noirq(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct chv_pinctrl *pctrl = platform_get_drvdata(pdev);
+@@ -1658,7 +1658,8 @@ static int chv_pinctrl_resume(struct dev
+ #endif
+
+ static const struct dev_pm_ops chv_pinctrl_pm_ops = {
+- SET_LATE_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend, chv_pinctrl_resume)
++ SET_NOIRQ_SYSTEM_SLEEP_PM_OPS(chv_pinctrl_suspend_noirq,
++ chv_pinctrl_resume_noirq)
+ };
+
+ static const struct acpi_device_id chv_pinctrl_acpi_match[] = {
--- /dev/null
+From 56211121c0825cd188caad05574fdc518d5cac6f Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Mon, 31 Oct 2016 16:57:32 +0200
+Subject: pinctrl: cherryview: Serialize register access in suspend/resume
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 56211121c0825cd188caad05574fdc518d5cac6f upstream.
+
+If async suspend is enabled, the driver may access registers concurrently
+with another instance which may fail because of the bug in Cherryview GPIO
+hardware. Prevent this by taking the shared lock while accessing the
+hardware in suspend and resume hooks.
+
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -1568,8 +1568,11 @@ static int chv_pinctrl_suspend(struct de
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct chv_pinctrl *pctrl = platform_get_drvdata(pdev);
++ unsigned long flags;
+ int i;
+
++ raw_spin_lock_irqsave(&chv_lock, flags);
++
+ pctrl->saved_intmask = readl(pctrl->regs + CHV_INTMASK);
+
+ for (i = 0; i < pctrl->community->npins; i++) {
+@@ -1590,6 +1593,8 @@ static int chv_pinctrl_suspend(struct de
+ ctx->padctrl1 = readl(reg);
+ }
+
++ raw_spin_unlock_irqrestore(&chv_lock, flags);
++
+ return 0;
+ }
+
+@@ -1597,8 +1602,11 @@ static int chv_pinctrl_resume(struct dev
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+ struct chv_pinctrl *pctrl = platform_get_drvdata(pdev);
++ unsigned long flags;
+ int i;
+
++ raw_spin_lock_irqsave(&chv_lock, flags);
++
+ /*
+ * Mask all interrupts before restoring per-pin configuration
+ * registers because we don't know in which state BIOS left them
+@@ -1643,6 +1651,8 @@ static int chv_pinctrl_resume(struct dev
+ chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
+ chv_writel(pctrl->saved_intmask, pctrl->regs + CHV_INTMASK);
+
++ raw_spin_unlock_irqrestore(&chv_lock, flags);
++
+ return 0;
+ }
+ #endif
--- /dev/null
+From 17c1c9ba15b238ef79b51cf40d855c05b58d5934 Mon Sep 17 00:00:00 2001
+From: Paul Fertser <fercerpav@gmail.com>
+Date: Thu, 27 Oct 2016 17:22:09 +0300
+Subject: Revert "staging: nvec: ps2: change serio type to passthrough"
+
+From: Paul Fertser <fercerpav@gmail.com>
+
+commit 17c1c9ba15b238ef79b51cf40d855c05b58d5934 upstream.
+
+This reverts commit 36b30d6138f4677514aca35ab76c20c1604baaad.
+
+This is necessary to detect paz00 (ac100) touchpad properly as one
+speaking ETPS/2 protocol. Without it X.org's synaptics driver doesn't
+work as the touchpad is detected as an ImPS/2 mouse instead.
+
+Commit ec6184b1c717b8768122e25fe6d312f609cc1bb4 changed the way
+auto-detection is performed on ports marked as pass through and made the
+issue apparent.
+
+A pass through port is an additional PS/2 port used to connect a slave
+device to a master device that is using PS/2 to communicate with the
+host (so slave's PS/2 communication is tunneled over master's PS/2
+link). "Synaptics PS/2 TouchPad Interfacing Guide" describes such a
+setup (PS/2 PASS-THROUGH OPTION section).
+
+Since paz00's embedded controller is not connected to a PS/2 port
+itself, the PS/2 interface it exposes is not a pass-through one.
+
+Signed-off-by: Paul Fertser <fercerpav@gmail.com>
+Acked-by: Marc Dietrich <marvin24@gmx.de>
+Fixes: 36b30d6138f4 ("staging: nvec: ps2: change serio type to passthrough")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/nvec/nvec_ps2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/nvec/nvec_ps2.c
++++ b/drivers/staging/nvec/nvec_ps2.c
+@@ -111,7 +111,7 @@ static int nvec_mouse_probe(struct platf
+ if (!ser_dev)
+ return -ENOMEM;
+
+- ser_dev->id.type = SERIO_PS_PSTHRU;
++ ser_dev->id.type = SERIO_8042;
+ ser_dev->write = ps2_sendcommand;
+ ser_dev->start = ps2_startstreaming;
+ ser_dev->stop = ps2_stopstreaming;
--- /dev/null
+From 237d6e6884136923b6bd26d5141ebe1d065960c9 Mon Sep 17 00:00:00 2001
+From: Michael Holzheu <holzheu@linux.vnet.ibm.com>
+Date: Tue, 25 Oct 2016 16:24:28 +0200
+Subject: s390/hypfs: Use get_free_page() instead of kmalloc to ensure page alignment
+
+From: Michael Holzheu <holzheu@linux.vnet.ibm.com>
+
+commit 237d6e6884136923b6bd26d5141ebe1d065960c9 upstream.
+
+Since commit d86bd1bece6f ("mm/slub: support left redzone") it is no longer
+guaranteed that kmalloc(PAGE_SIZE) returns page aligned memory.
+
+After the above commit we get an error for diag224 because aligned
+memory is required. This leads to the following user visible error:
+
+ # mount none -t s390_hypfs /sys/hypervisor/
+ mount: unknown filesystem type 's390_hypfs'
+
+ # dmesg | grep hypfs
+ hypfs.cccfb8: The hardware system does not provide all functions
+ required by hypfs
+ hypfs.7a79f0: Initialization of hypfs failed with rc=-61
+
+Fix this problem and use get_free_page() instead of kmalloc() to get
+correctly aligned memory.
+
+Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/s390/hypfs/hypfs_diag.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/s390/hypfs/hypfs_diag.c
++++ b/arch/s390/hypfs/hypfs_diag.c
+@@ -525,11 +525,11 @@ static int diag224(void *ptr)
+ static int diag224_get_name_table(void)
+ {
+ /* memory must be below 2GB */
+- diag224_cpu_names = kmalloc(PAGE_SIZE, GFP_KERNEL | GFP_DMA);
++ diag224_cpu_names = (char *) __get_free_page(GFP_KERNEL | GFP_DMA);
+ if (!diag224_cpu_names)
+ return -ENOMEM;
+ if (diag224(diag224_cpu_names)) {
+- kfree(diag224_cpu_names);
++ free_page((unsigned long) diag224_cpu_names);
+ return -EOPNOTSUPP;
+ }
+ EBCASC(diag224_cpu_names + 16, (*diag224_cpu_names + 1) * 16);
+@@ -538,7 +538,7 @@ static int diag224_get_name_table(void)
+
+ static void diag224_delete_name_table(void)
+ {
+- kfree(diag224_cpu_names);
++ free_page((unsigned long) diag224_cpu_names);
+ }
+
+ static int diag224_idx2name(int index, char *name)
--- /dev/null
+From 6d3a56ed098566bc83d6c2afa74b4199c12ea074 Mon Sep 17 00:00:00 2001
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Date: Fri, 28 Oct 2016 10:09:12 +0530
+Subject: scsi: mpt3sas: Fix for block device of raid exists even after deleting raid disk
+
+From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+
+commit 6d3a56ed098566bc83d6c2afa74b4199c12ea074 upstream.
+
+While merging mpt3sas & mpt2sas code, we added the is_warpdrive check
+condition on the wrong line
+
+---------------------------------------------------------------------------
+ scsih_target_alloc(struct scsi_target *starget)
+ sas_target_priv_data->handle = raid_device->handle;
+ sas_target_priv_data->sas_address = raid_device->wwid;
+ sas_target_priv_data->flags |= MPT_TARGET_FLAGS_VOLUME;
+- raid_device->starget = starget;
++ sas_target_priv_data->raid_device = raid_device;
++ if (ioc->is_warpdrive)
++ raid_device->starget = starget;
+ }
+ spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ return 0;
+------------------------------------------------------------------------------
+
+That check should be for the line sas_target_priv_data->raid_device =
+raid_device;
+
+Due to above hunk, we are not initializing raid_device's starget for
+raid volumes, and so during raid disk deletion driver is not calling
+scsi_remove_target() API as driver observes starget field of
+raid_device's structure as NULL.
+
+Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@broadcom.com>
+Fixes: 7786ab6aff9 ("mpt3sas: Ported WarpDrive product SSS6200 support")
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+@@ -1275,9 +1275,9 @@ scsih_target_alloc(struct scsi_target *s
+ sas_target_priv_data->handle = raid_device->handle;
+ sas_target_priv_data->sas_address = raid_device->wwid;
+ sas_target_priv_data->flags |= MPT_TARGET_FLAGS_VOLUME;
+- sas_target_priv_data->raid_device = raid_device;
+ if (ioc->is_warpdrive)
+- raid_device->starget = starget;
++ sas_target_priv_data->raid_device = raid_device;
++ raid_device->starget = starget;
+ }
+ spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
+ return 0;
--- /dev/null
+From a5dd506e1584e91f3e7500ab9a165aa1b49eabd4 Mon Sep 17 00:00:00 2001
+From: Bill Kuzeja <William.Kuzeja@stratus.com>
+Date: Fri, 21 Oct 2016 16:45:27 -0400
+Subject: scsi: qla2xxx: Fix scsi scan hang triggered if adapter fails during init
+
+From: Bill Kuzeja <William.Kuzeja@stratus.com>
+
+commit a5dd506e1584e91f3e7500ab9a165aa1b49eabd4 upstream.
+
+A system can get hung task timeouts if a qlogic board fails during
+initialization (if the board breaks again or fails the init). The hang
+involves the scsi scan.
+
+In a nutshell, since commit beb9e315e6e0 ("qla2xxx: Prevent removal and
+board_disable race"):
+
+...it is possible to have freed ha (base_vha->hw) early by a call to
+qla2x00_remove_one when pdev->enable_cnt equals zero:
+
+ if (!atomic_read(&pdev->enable_cnt)) {
+ scsi_host_put(base_vha->host);
+ kfree(ha);
+ pci_set_drvdata(pdev, NULL);
+ return;
+
+Almost always, the scsi_host_put above frees the vha structure
+(attached to the end of the Scsi_Host we're putting) since it's the last
+put, and life is good. However, if we are entering this routine because
+the adapter has broken sometime during initialization AND a scsi scan is
+already in progress (and has done its own scsi_host_get), vha will not
+be freed. What's worse, the scsi scan will access the freed ha structure
+through qla2xxx_scan_finished:
+
+ if (time > vha->hw->loop_reset_delay * HZ)
+ return 1;
+
+The scsi scan keeps checking to see if a scan is complete by calling
+qla2xxx_scan_finished. There is a timeout value that limits the length
+of time a scan can take (hw->loop_reset_delay, usually set to 5
+seconds), but this definition is in the data structure (hw) that can get
+freed early.
+
+This can yield unpredictable results, the worst of which is that the
+scsi scan can hang indefinitely. This happens when the freed structure
+gets reused and loop_reset_delay gets overwritten with garbage, which
+the scan obliviously uses as its timeout value.
+
+The fix for this is simple: at the top of qla2xxx_scan_finished, check
+for the UNLOADING bit in the vha structure (_vha is not freed at this
+point). If UNLOADING is set, we exit the scan for this adapter
+immediately. After this last reference to the ha structure, we'll exit
+the scan for this adapter, and continue on.
+
+This problem is hard to hit, but I have run into it doing negative
+testing many times now (with a test specifically designed to bring it
+out), so I can verify that this fix works. My testing has been against a
+RHEL7 driver variant, but the bug and patch are equally relevant to to
+the upstream driver.
+
+Fixes: beb9e315e6e0 ("qla2xxx: Prevent removal and board_disable race")
+Signed-off-by: Bill Kuzeja <william.kuzeja@stratus.com>
+Acked-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_os.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -2257,6 +2257,8 @@ qla2xxx_scan_finished(struct Scsi_Host *
+ {
+ scsi_qla_host_t *vha = shost_priv(shost);
+
++ if (test_bit(UNLOADING, &vha->dpc_flags))
++ return 1;
+ if (!vha->host)
+ return 1;
+ if (time > vha->hw->loop_reset_delay * HZ)
alsa-info-limit-the-proc-text-input-size.patch
asoc-cs4270-fix-dapm-stream-name-mismatch.patch
dib0700-fix-nec-repeat-handling.patch
+swapfile-fix-memory-corruption-via-malformed-swapfile.patch
+coredump-fix-unfreezable-coredumping-task.patch
+s390-hypfs-use-get_free_page-instead-of-kmalloc-to-ensure-page-alignment.patch
+arc-timer-rtc-implement-read-loop-in-c-vs.-inline-asm.patch
+pinctrl-cherryview-serialize-register-access-in-suspend-resume.patch
+pinctrl-cherryview-prevent-possible-interrupt-storm-on-resume.patch
+staging-iio-ad5933-avoid-uninitialized-variable-in-error-case.patch
+drivers-staging-nvec-remove-bogus-reset-command-for-ps-2-interface.patch
+revert-staging-nvec-ps2-change-serio-type-to-passthrough.patch
+staging-nvec-remove-managed-resource-from-ps2-driver.patch
+usb-cdc-acm-fix-tiocmiwait.patch
+usb-gadget-u_ether-remove-interrupt-throttling.patch
+drbd-fix-kernel_sendmsg-usage-potential-null-deref.patch
+toshiba-wmi-fix-loading-the-driver-on-non-toshiba-laptops.patch
+clk-qoriq-don-t-allow-cpu-clocks-higher-than-starting-value.patch
+iio-hid-sensors-increase-the-precision-of-scale-to-fix-wrong-reading-interpretation.patch
+iio-orientation-hid-sensor-rotation-add-pm-function-fix-non-working-driver.patch
+scsi-qla2xxx-fix-scsi-scan-hang-triggered-if-adapter-fails-during-init.patch
+scsi-mpt3sas-fix-for-block-device-of-raid-exists-even-after-deleting-raid-disk.patch
+kvm-mips-precalculate-mmio-load-resume-pc.patch
+drm-radeon-disable-runtime-pm-in-certain-cases.patch
+drm-i915-respect-alternate_ddc_pin-for-all-ddi-ports.patch
+drm-amdgpu-disable-runtime-pm-in-certain-cases.patch
--- /dev/null
+From 34eee70a7b82b09dbda4cb453e0e21d460dae226 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 24 Oct 2016 17:22:01 +0200
+Subject: staging: iio: ad5933: avoid uninitialized variable in error case
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 34eee70a7b82b09dbda4cb453e0e21d460dae226 upstream.
+
+The ad5933_i2c_read function returns an error code to indicate
+whether it could read data or not. However ad5933_work() ignores
+this return code and just accesses the data unconditionally,
+which gets detected by gcc as a possible bug:
+
+drivers/staging/iio/impedance-analyzer/ad5933.c: In function 'ad5933_work':
+drivers/staging/iio/impedance-analyzer/ad5933.c:649:16: warning: 'status' may be used uninitialized in this function [-Wmaybe-uninitialized]
+
+This adds minimal error handling so we only evaluate the
+data if it was correctly read.
+
+Link: https://patchwork.kernel.org/patch/8110281/
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/iio/impedance-analyzer/ad5933.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
++++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
+@@ -647,6 +647,7 @@ static void ad5933_work(struct work_stru
+ __be16 buf[2];
+ int val[2];
+ unsigned char status;
++ int ret;
+
+ mutex_lock(&indio_dev->mlock);
+ if (st->state == AD5933_CTRL_INIT_START_FREQ) {
+@@ -654,19 +655,22 @@ static void ad5933_work(struct work_stru
+ ad5933_cmd(st, AD5933_CTRL_START_SWEEP);
+ st->state = AD5933_CTRL_START_SWEEP;
+ schedule_delayed_work(&st->work, st->poll_time_jiffies);
+- mutex_unlock(&indio_dev->mlock);
+- return;
++ goto out;
+ }
+
+- ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status);
++ ret = ad5933_i2c_read(st->client, AD5933_REG_STATUS, 1, &status);
++ if (ret)
++ goto out;
+
+ if (status & AD5933_STAT_DATA_VALID) {
+ int scan_count = bitmap_weight(indio_dev->active_scan_mask,
+ indio_dev->masklength);
+- ad5933_i2c_read(st->client,
++ ret = ad5933_i2c_read(st->client,
+ test_bit(1, indio_dev->active_scan_mask) ?
+ AD5933_REG_REAL_DATA : AD5933_REG_IMAG_DATA,
+ scan_count * 2, (u8 *)buf);
++ if (ret)
++ goto out;
+
+ if (scan_count == 2) {
+ val[0] = be16_to_cpu(buf[0]);
+@@ -678,8 +682,7 @@ static void ad5933_work(struct work_stru
+ } else {
+ /* no data available - try again later */
+ schedule_delayed_work(&st->work, st->poll_time_jiffies);
+- mutex_unlock(&indio_dev->mlock);
+- return;
++ goto out;
+ }
+
+ if (status & AD5933_STAT_SWEEP_DONE) {
+@@ -691,7 +694,7 @@ static void ad5933_work(struct work_stru
+ ad5933_cmd(st, AD5933_CTRL_INC_FREQ);
+ schedule_delayed_work(&st->work, st->poll_time_jiffies);
+ }
+-
++out:
+ mutex_unlock(&indio_dev->mlock);
+ }
+
--- /dev/null
+From 68fae2f3df455f53d0dfe33483a49020b3b758f3 Mon Sep 17 00:00:00 2001
+From: Marc Dietrich <marvin24@gmx.de>
+Date: Tue, 1 Nov 2016 13:59:40 +0100
+Subject: staging: nvec: remove managed resource from PS2 driver
+
+From: Marc Dietrich <marvin24@gmx.de>
+
+commit 68fae2f3df455f53d0dfe33483a49020b3b758f3 upstream.
+
+This basicly reverts commit e534f3e9 (staging:nvec: Introduce the use of
+the managed version of kzalloc). Serio struct should never by managed
+because it is refcounted. Doing so will lead to a double free oops on module
+remove.
+
+Signed-off-by: Marc Dietrich <marvin24@gmx.de>
+Fixes: e534f3e9429f ("staging:nvec: Introduce the use of the managed version of kzalloc")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/nvec/nvec_ps2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/nvec/nvec_ps2.c
++++ b/drivers/staging/nvec/nvec_ps2.c
+@@ -107,7 +107,7 @@ static int nvec_mouse_probe(struct platf
+ struct nvec_chip *nvec = dev_get_drvdata(pdev->dev.parent);
+ struct serio *ser_dev;
+
+- ser_dev = devm_kzalloc(&pdev->dev, sizeof(struct serio), GFP_KERNEL);
++ ser_dev = kzalloc(sizeof(struct serio), GFP_KERNEL);
+ if (!ser_dev)
+ return -ENOMEM;
+
--- /dev/null
+From dd111be69114cc867f8e826284559bfbc1c40e37 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jann@thejh.net>
+Date: Thu, 10 Nov 2016 10:46:19 -0800
+Subject: swapfile: fix memory corruption via malformed swapfile
+
+From: Jann Horn <jann@thejh.net>
+
+commit dd111be69114cc867f8e826284559bfbc1c40e37 upstream.
+
+When root activates a swap partition whose header has the wrong
+endianness, nr_badpages elements of badpages are swabbed before
+nr_badpages has been checked, leading to a buffer overrun of up to 8GB.
+
+This normally is not a security issue because it can only be exploited
+by root (more specifically, a process with CAP_SYS_ADMIN or the ability
+to modify a swap file/partition), and such a process can already e.g.
+modify swapped-out memory of any other userspace process on the system.
+
+Link: http://lkml.kernel.org/r/1477949533-2509-1-git-send-email-jann@thejh.net
+Signed-off-by: Jann Horn <jann@thejh.net>
+Acked-by: Kees Cook <keescook@chromium.org>
+Acked-by: Jerome Marchand <jmarchan@redhat.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/swapfile.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -2225,6 +2225,8 @@ static unsigned long read_swap_header(st
+ swab32s(&swap_header->info.version);
+ swab32s(&swap_header->info.last_page);
+ swab32s(&swap_header->info.nr_badpages);
++ if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES)
++ return 0;
+ for (i = 0; i < swap_header->info.nr_badpages; i++)
+ swab32s(&swap_header->info.badpages[i]);
+ }
--- /dev/null
+From 1c80e9603fe8341ed5bea696747d07083d5e0476 Mon Sep 17 00:00:00 2001
+From: Azael Avalos <coproscefalo@gmail.com>
+Date: Thu, 25 Aug 2016 12:50:55 -0600
+Subject: toshiba-wmi: Fix loading the driver on non Toshiba laptops
+
+From: Azael Avalos <coproscefalo@gmail.com>
+
+commit 1c80e9603fe8341ed5bea696747d07083d5e0476 upstream.
+
+Bug 150611 uncovered that the WMI ID used by the toshiba-wmi driver
+is not Toshiba specific, and as such, the driver was being loaded
+on non Toshiba laptops too.
+
+This patch adds a DMI matching list checking for TOSHIBA as the
+vendor, refusing to load if it is not.
+
+Also the WMI GUID was renamed, dropping the TOSHIBA_ prefix, to
+better reflect that such GUID is not a Toshiba specific one.
+
+Signed-off-by: Azael Avalos <coproscefalo@gmail.com>
+Signed-off-by: Darren Hart <dvhart@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/x86/toshiba-wmi.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+--- a/drivers/platform/x86/toshiba-wmi.c
++++ b/drivers/platform/x86/toshiba-wmi.c
+@@ -24,14 +24,15 @@
+ #include <linux/acpi.h>
+ #include <linux/input.h>
+ #include <linux/input/sparse-keymap.h>
++#include <linux/dmi.h>
+
+ MODULE_AUTHOR("Azael Avalos");
+ MODULE_DESCRIPTION("Toshiba WMI Hotkey Driver");
+ MODULE_LICENSE("GPL");
+
+-#define TOSHIBA_WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100"
++#define WMI_EVENT_GUID "59142400-C6A3-40FA-BADB-8A2652834100"
+
+-MODULE_ALIAS("wmi:"TOSHIBA_WMI_EVENT_GUID);
++MODULE_ALIAS("wmi:"WMI_EVENT_GUID);
+
+ static struct input_dev *toshiba_wmi_input_dev;
+
+@@ -63,6 +64,16 @@ static void toshiba_wmi_notify(u32 value
+ kfree(response.pointer);
+ }
+
++static struct dmi_system_id toshiba_wmi_dmi_table[] __initdata = {
++ {
++ .ident = "Toshiba laptop",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ },
++ },
++ {}
++};
++
+ static int __init toshiba_wmi_input_setup(void)
+ {
+ acpi_status status;
+@@ -81,7 +92,7 @@ static int __init toshiba_wmi_input_setu
+ if (err)
+ goto err_free_dev;
+
+- status = wmi_install_notify_handler(TOSHIBA_WMI_EVENT_GUID,
++ status = wmi_install_notify_handler(WMI_EVENT_GUID,
+ toshiba_wmi_notify, NULL);
+ if (ACPI_FAILURE(status)) {
+ err = -EIO;
+@@ -95,7 +106,7 @@ static int __init toshiba_wmi_input_setu
+ return 0;
+
+ err_remove_notifier:
+- wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID);
++ wmi_remove_notify_handler(WMI_EVENT_GUID);
+ err_free_keymap:
+ sparse_keymap_free(toshiba_wmi_input_dev);
+ err_free_dev:
+@@ -105,7 +116,7 @@ static int __init toshiba_wmi_input_setu
+
+ static void toshiba_wmi_input_destroy(void)
+ {
+- wmi_remove_notify_handler(TOSHIBA_WMI_EVENT_GUID);
++ wmi_remove_notify_handler(WMI_EVENT_GUID);
+ sparse_keymap_free(toshiba_wmi_input_dev);
+ input_unregister_device(toshiba_wmi_input_dev);
+ }
+@@ -114,7 +125,8 @@ static int __init toshiba_wmi_init(void)
+ {
+ int ret;
+
+- if (!wmi_has_guid(TOSHIBA_WMI_EVENT_GUID))
++ if (!wmi_has_guid(WMI_EVENT_GUID) ||
++ !dmi_check_system(toshiba_wmi_dmi_table))
+ return -ENODEV;
+
+ ret = toshiba_wmi_input_setup();
+@@ -130,7 +142,7 @@ static int __init toshiba_wmi_init(void)
+
+ static void __exit toshiba_wmi_exit(void)
+ {
+- if (wmi_has_guid(TOSHIBA_WMI_EVENT_GUID))
++ if (wmi_has_guid(WMI_EVENT_GUID))
+ toshiba_wmi_input_destroy();
+ }
+
--- /dev/null
+From 18266403f3fe507f0246faa1d5432333a2f139ca Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 8 Nov 2016 13:10:57 +0100
+Subject: USB: cdc-acm: fix TIOCMIWAIT
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 18266403f3fe507f0246faa1d5432333a2f139ca upstream.
+
+The TIOCMIWAIT implementation would return -EINVAL if any of the three
+supported signals were included in the mask.
+
+Instead of returning an error in case TIOCM_CTS is included, simply
+drop the mask check completely, which is in accordance with how other
+drivers implement this ioctl.
+
+Fixes: 5a6a62bdb925 ("cdc-acm: add TIOCMIWAIT")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/class/cdc-acm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -877,8 +877,6 @@ static int wait_serial_change(struct acm
+ DECLARE_WAITQUEUE(wait, current);
+ struct async_icount old, new;
+
+- if (arg & (TIOCM_DSR | TIOCM_RI | TIOCM_CD ))
+- return -EINVAL;
+ do {
+ spin_lock_irq(&acm->read_lock);
+ old = acm->oldcount;
--- /dev/null
+From fd9afd3cbe404998d732be6cc798f749597c5114 Mon Sep 17 00:00:00 2001
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+Date: Tue, 1 Nov 2016 13:20:22 +0200
+Subject: usb: gadget: u_ether: remove interrupt throttling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Felipe Balbi <felipe.balbi@linux.intel.com>
+
+commit fd9afd3cbe404998d732be6cc798f749597c5114 upstream.
+
+According to Dave Miller "the networking stack has a
+hard requirement that all SKBs which are transmitted
+must have their completion signalled in a fininte
+amount of time. This is because, until the SKB is
+freed by the driver, it holds onto socket,
+netfilter, and other subsystem resources."
+
+In summary, this means that using TX IRQ throttling
+for the networking gadgets is, at least, complex and
+we should avoid it for the time being.
+
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Suggested-by: David Miller <davem@davemloft.net>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/function/u_ether.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/drivers/usb/gadget/function/u_ether.c
++++ b/drivers/usb/gadget/function/u_ether.c
+@@ -594,14 +594,6 @@ static netdev_tx_t eth_start_xmit(struct
+
+ req->length = length;
+
+- /* throttle high/super speed IRQ rate back slightly */
+- if (gadget_is_dualspeed(dev->gadget))
+- req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH ||
+- dev->gadget->speed == USB_SPEED_SUPER)) &&
+- !list_empty(&dev->tx_reqs))
+- ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0)
+- : 0;
+-
+ retval = usb_ep_queue(in, req, GFP_ATOMIC);
+ switch (retval) {
+ default:
projects / thirdparty / kernel / stable-queue.git / commitdiff
