commit 5d506f2133aa81e4a65130c148409512c8f51d7c Author: Greg Kroah-Hartman Date: Mon Oct 31 05:26:46 2016 -0600 Linux 4.8.6 commit 13c06fcc4a776dca0e23e15677d4884c9f4f40f9 Author: Vishal Verma Date: Fri Sep 30 17:19:31 2016 -0600 libnvdimm: clear the internal poison_list when clearing badblocks commit e046114af5fcafe8d6d3f0b6ccb99804bad34bfb upstream. nvdimm_clear_poison cleared the user-visible badblocks, and sent commands to the NVDIMM to clear the areas marked as 'poison', but it neglected to clear the same areas from the internal poison_list which is used to marshal ARS results before sorting them by namespace. As a result, once on-demand ARS functionality was added: 37b137f nfit, libnvdimm: allow an ARS scrub to be triggered on demand A scrub triggered from either sysfs or an MCE was found to be adding stale entries that had been cleared from gendisk->badblocks, but were still present in nvdimm_bus->poison_list. Additionally, the stale entries could be triggered into producing stale disk->badblocks by simply disabling and re-enabling the namespace or region. This adds the missing step of clearing poison_list entries when clearing poison, so that it is always in sync with badblocks. Fixes: 37b137f ("nfit, libnvdimm: allow an ARS scrub to be triggered on demand") Signed-off-by: Vishal Verma Signed-off-by: Dan Williams Signed-off-by: Greg Kroah-Hartman commit 10a12e89de35ed6aa94b5b2002e887a9c867547d Author: Lorenzo Pieralisi Date: Mon Aug 15 17:50:46 2016 +0100 PCI: tegra: Fix pci_remap_iospace() failure path commit 13f392ebc37e31568fae72a73ee378ae22a9740f upstream. On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped IO, by reserving a chunk of virtual address space starting at PCI_IOBASE and by mapping the PCI host bridges memory address space driving PCI IO cycles to it. PCI host bridge drivers that enable downstream PCI IO cycles map the host bridge memory address responding to PCI IO cycles to the fixed virtual address space through the pci_remap_iospace() API. This means that if the pci_remap_iospace() function fails, the corresponding host bridge PCI IO resource must be considered invalid, in that there is no way for the kernel to actually drive PCI IO transactions if the memory addresses responding to PCI IO cycles cannot be mapped into the CPU virtual address space. The PCI tegra host bridge driver adds the PCI IO resource retrieved from firmware to the host bridge resource windows even if the pci_remap_iospace() call fails; this is an actual bug in that the PCI host bridge would consider the PCI IO resource valid (and possibly assign it to downstream devices) even if the kernel was not able to map the PCI host bridge memory address driving IO cycle to the CPU virtual address space (ie pci_remap_iospace() failures). Add the PCI host bridge driver pci_remap_iospace() failure path and do not add the corresponding PCI host bridge PCI IO resources retrieved through firmware when the pci_remap_iospace() function call fails, fixing the issue. Fixes: e6e9f471f5fe ("PCI: tegra: Use generic pci_remap_iospace() rather than ARM32-specific one") Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas CC: Thierry Reding Signed-off-by: Greg Kroah-Hartman commit 12d904f4dbe29384f573fa4f422bf68b0e0c80e9 Author: Lorenzo Pieralisi Date: Mon Aug 15 17:50:42 2016 +0100 PCI: designware: Fix pci_remap_iospace() failure path commit bcd7b7186fcba434e7486648de85cf93a56c845c upstream. On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped IO, by reserving a chunk of virtual address space starting at PCI_IOBASE and by mapping the PCI host bridges memory address space driving PCI IO cycles to it. PCI host bridge drivers that enable downstream PCI IO cycles map the host bridge memory address responding to PCI IO cycles to the fixed virtual address space through the pci_remap_iospace() API. This means that if the pci_remap_iospace() function fails, the corresponding host bridge PCI IO resource must be considered invalid, in that there is no way for the kernel to actually drive PCI IO transactions if the memory addresses responding to PCI IO cycles cannot be mapped into the CPU virtual address space. The PCI designware host bridge driver does not remove the PCI IO resource from the host bridge resource windows if the pci_remap_iospace() call fails; this is an actual bug in that the PCI host bridge would consider the PCI IO resource valid (and possibly assign it to downstream devices) even if the kernel was not able to map the PCI host bridge memory address driving IO cycle to the CPU virtual address space (ie pci_remap_iospace() failures). Fix the PCI host bridge driver pci_remap_iospace() failure path, by destroying the PCI host bridge PCI IO resources retrieved through firmware when the pci_remap_iospace() function call fails, therefore preventing the kernel from adding the respective PCI IO resource to the list of PCI host bridge valid resources, fixing the issue. Fixes: cbce7900598c ("PCI: designware: Make driver arch-agnostic") Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas CC: Jingoo Han CC: Pratyush Anand Signed-off-by: Greg Kroah-Hartman commit 9a7f38f1ba555724fd1abc55d133add9b863c92d Author: Lorenzo Pieralisi Date: Mon Aug 15 17:50:43 2016 +0100 PCI: versatile: Fix pci_remap_iospace() failure path commit 53f4f7ee28076a36e427274d7d5c33b23dfc6221 upstream. On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped IO, by reserving a chunk of virtual address space starting at PCI_IOBASE and by mapping the PCI host bridges memory address space driving PCI IO cycles to it. PCI host bridge drivers that enable downstream PCI IO cycles map the host bridge memory address responding to PCI IO cycles to the fixed virtual address space through the pci_remap_iospace() API. This means that if the pci_remap_iospace() function fails, the corresponding host bridge PCI IO resource must be considered invalid, in that there is no way for the kernel to actually drive PCI IO transactions if the memory addresses responding to PCI IO cycles cannot be mapped into the CPU virtual address space. The PCI versatile host bridge driver does not remove the PCI IO resource from the host bridge resource windows if the pci_remap_iospace() call fails; this is an actual bug in that the PCI host bridge would consider the PCI IO resource valid (and possibly assign it to downstream devices) even if the kernel was not able to map the PCI host bridge memory address driving IO cycle to the CPU virtual address space (ie pci_remap_iospace() failures). Fix the PCI host bridge driver pci_remap_iospace() failure path, by destroying the PCI host bridge PCI IO resources retrieved through firmware when the pci_remap_iospace() function call fails, therefore preventing the kernel from adding the respective PCI IO resource to the list of PCI host bridge valid resources, fixing the issue. Fixes: b7e78170efd4 ("PCI: versatile: Add DT-based ARM Versatile PB PCIe host driver") Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas CC: Rob Herring Signed-off-by: Greg Kroah-Hartman commit 57ac6016db6a9cd5810b6d0d69da47b4a6364ca4 Author: Lorenzo Pieralisi Date: Mon Aug 15 17:50:45 2016 +0100 PCI: generic: Fix pci_remap_iospace() failure path commit 43281ede019ede33fd0c40a14a86b304a51e4555 upstream. On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped IO, by reserving a chunk of virtual address space starting at PCI_IOBASE and by mapping the PCI host bridges memory address space driving PCI IO cycles to it. PCI host bridge drivers that enable downstream PCI IO cycles map the host bridge memory address responding to PCI IO cycles to the fixed virtual address space through the pci_remap_iospace() API. This means that if the pci_remap_iospace() function fails, the corresponding host bridge PCI IO resource must be considered invalid, in that there is no way for the kernel to actually drive PCI IO transactions if the memory addresses responding to PCI IO cycles cannot be mapped into the CPU virtual address space. The PCI common host bridge driver does not remove the PCI IO resource from the host bridge resource windows if the pci_remap_iospace() call fails; this is an actual bug in that the PCI host bridge would consider the PCI IO resource valid (and possibly assign it to downstream devices) even if the kernel was not able to map the PCI host bridge memory address driving IO cycle to the CPU virtual address space (ie pci_remap_iospace() failures). Fix the PCI host bridge driver pci_remap_iospace() failure path, by destroying the PCI host bridge PCI IO resources retrieved through firmware when the pci_remap_iospace() function call fails, therefore preventing the kernel from adding the respective PCI IO resource to the list of PCI host bridge valid resources, fixing the issue. Fixes: 4e64dbe226e7 ("PCI: generic: Expose pci_host_common_probe() for use by other drivers") Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Acked-by: Will Deacon Signed-off-by: Greg Kroah-Hartman commit fb98cd862f040b1772820c7d56e8bf5fc73ebed1 Author: Lorenzo Pieralisi Date: Mon Aug 15 17:50:41 2016 +0100 PCI: aardvark: Fix pci_remap_iospace() failure path commit db047f8a931275e50563dd79c3d62d977074959a upstream. On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped IO, by reserving a chunk of virtual address space starting at PCI_IOBASE and by mapping the PCI host bridge's memory address space driving PCI IO cycles to it. PCI host bridge drivers that enable downstream PCI IO cycles map the host bridge memory address responding to PCI IO cycles to the fixed virtual address space through the pci_remap_iospace() API. This means that if the pci_remap_iospace() function fails, the corresponding host bridge PCI IO resource must be considered invalid, in that there is no way for the kernel to actually drive PCI IO transactions if the memory addresses responding to PCI IO cycles cannot be mapped into the CPU virtual address space. The PCI aardvark host bridge driver does not remove the PCI IO resource from the host bridge resource windows if the pci_remap_iospace() call fails; this is an actual bug in that the PCI host bridge would consider the PCI IO resource valid (and possibly assign it to downstream devices) even if the kernel was not able to map the PCI host bridge memory address driving IO cycle to the CPU virtual address space (ie pci_remap_iospace() failures). Fix the PCI host bridge driver pci_remap_iospace() failure path, by destroying the PCI host bridge PCI IO resources retrieved through firmware when the pci_remap_iospace() function call fails, therefore preventing the kernel from adding the respective PCI IO resource to the list of PCI host bridge valid resources, fixing the issue. Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver") Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas CC: Thomas Petazzoni Signed-off-by: Greg Kroah-Hartman commit c76bf06c9cd4ad8d09bb072ffe53e5643cf3ef48 Author: Lorenzo Pieralisi Date: Mon Aug 15 17:50:44 2016 +0100 PCI: rcar: Fix pci_remap_iospace() failure path commit 5e8c873270cc618e3326eb6a47437b517ef85c52 upstream. On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped IO, by reserving a chunk of virtual address space starting at PCI_IOBASE and by mapping the PCI host bridges memory address space driving PCI IO cycles to it. PCI host bridge drivers that enable downstream PCI IO cycles map the host bridge memory address responding to PCI IO cycles to the fixed virtual address space through the pci_remap_iospace() API. This means that if the pci_remap_iospace() function fails, the corresponding host bridge PCI IO resource must be considered invalid, in that there is no way for the kernel to actually drive PCI IO transactions if the memory addresses responding to PCI IO cycles cannot be mapped into the CPU virtual address space. The PCI rcar host bridge driver does not remove the PCI IO resource from the host bridge resource windows if the pci_remap_iospace() call fails; this is an actual bug in that the PCI host bridge would consider the PCI IO resource valid (and possibly assign it to downstream devices) even if the kernel was not able to map the PCI host bridge memory address driving IO cycle to the CPU virtual address space (ie pci_remap_iospace() failures). Fix the PCI host bridge driver pci_remap_iospace() failure path, by destroying the PCI host bridge PCI IO resources retrieved through firmware when the pci_remap_iospace() function call fails, therefore preventing the kernel from adding the respective PCI IO resource to the list of PCI host bridge valid resources, fixing the issue. Fixes: 5d2917d469fa ("PCI: rcar: Convert to DT resource parsing API") Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas CC: Phil Edworthy CC: Simon Horman Signed-off-by: Greg Kroah-Hartman commit 847fd175244d1a8862a66cd54dd6bc7277607848 Author: Javier Martinez Canillas Date: Mon Aug 1 12:46:56 2016 -0400 ARM: dts: omap3: overo: add missing unit name for lcd35 display commit 0b965a13ad81fa895e534d1f50b355ff8b0b3ed3 upstream. Commit b8d368caa8dc ("ARM: dts: omap3: overo: remove unneded unit names in display nodes") removed the unit names for all Overo display nodes that didn't have a reg property. But the display in arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi does have a reg property so the correct fix was to make the unit name match the value of the reg property, instead of removing it. This patch fixes the following DTC warning for boards using this dtsi: "ocp/spi@48098000/display has a reg or ranges property, but no unit name" Fixes: b8d368caa8dc ("ARM: dts: omap3: overo: remove unneded unit names in display nodes") Signed-off-by: Javier Martinez Canillas Signed-off-by: Tony Lindgren Signed-off-by: Greg Kroah-Hartman commit 45de0cf996baa776dbd4cc2e7231c82a4efe7340 Author: Linus Walleij Date: Thu Sep 8 10:48:38 2016 +0200 ARM: dts: fix RealView EB SMSC ethernet version commit c4ad72560df11961d3e57fb0fadfe88a9863c9ad upstream. The ethernet version in the earlier RealView EB variants is LAN91C111 and not LAN9118 according to ARM DUI 0303E "RealView Emulation Baseboard User Guide" page 3-57. Make sure that this is used for the base variant of the board. As the DT bindings for LAN91C111 does not specify any power supplies, these need to be deleted from the DTS file. Fixes: 2440d29d2ae2 ("ARM: dts: realview: support all the RealView EB board variants") Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman commit e566ea9a220a6462768570dec44abd2ed46378b8 Author: Jon Mason Date: Thu Jul 14 16:14:17 2016 -0400 ARM: dts: NSP: Correct RAM amount for BCM958625HR board commit c53beb47f621e4a56f31af9f86470041655516c7 upstream. The BCM958625HR board has 2GB of RAM available. Increase the amount from 512MB to 2GB and add the device type to the memory entry. Fixes: 9a4865d42fe5 ("ARM: dts: NSP: Specify RAM amount for BCM958625HR board") Signed-off-by: Jon Mason Signed-off-by: Florian Fainelli Signed-off-by: Greg Kroah-Hartman commit 96e4f098bcc2a346568133c7d2a7bf561090a3f5 Author: Robert Jarzmik Date: Tue Aug 2 00:01:32 2016 +0200 ARM: pxa: fix GPIO double shifts commit ca26475bf02ed8562b9b46f91d3e8b52ec312541 upstream. The commit 9bf448c66d4b ("ARM: pxa: use generic gpio operation instead of gpio register") from Oct 17, 2011, leads to the following static checker warning: arch/arm/mach-pxa/spitz_pm.c:172 spitz_charger_wakeup() warn: double left shift '!gpio_get_value(SPITZ_GPIO_KEY_INT) << (1 << ((SPITZ_GPIO_KEY_INT) & 31))' As Dan reported, the value is shifted three times : - once by gpio_get_value(), which returns either 0 or BIT(gpio) - once by the shift operation '<<' - a last time by GPIO_bit(gpio) which is BIT(gpio) Therefore the calculation lead to a chained or operator of : - (1 << gpio) << (1 << gpio) = (2^gpio)^gpio = 2 ^ (gpio * gpio) It is be sheer luck the former statement works, only because each gpio used is strictly smaller than 6, and therefore 2^(gpio^2) never overflows a 32 bits value, and because it is used as a boolean value to check a gpio activation. As the xxx_charger_wakeup() functions are used as a true/false detection mechanism, take that opportunity to change their prototypes from integer return value to boolean one. Fixes: 9bf448c66d4b ("ARM: pxa: use generic gpio operation instead of gpio register") Reported-by: Dan Carpenter Cc: Joe Perches Signed-off-by: Robert Jarzmik Signed-off-by: Greg Kroah-Hartman commit d685eefbf327f8de539a4a421134f01ec48421cd Author: Robert Jarzmik Date: Sun Sep 4 20:59:45 2016 +0200 ARM: pxa: pxa_cplds: fix interrupt handling commit 9ba63e3cc849cdaf3b675c47cc51fe35419e5117 upstream. Since its initial commit, the driver is buggy for multiple interrupts handling. The translation from the former lubbock.c file was not complete, and might stall all interrupt handling when multiple interrupts occur. This is especially true when inside the interrupt handler and if a new interrupt comes and is not handled, leaving the output line still held, and not creating a transition as the GPIO block behind would expect to trigger another cplds_irq_handler() call. For the record, the hardware is working as follows. The interrupt mechanism relies on : - one status register - one mask register Let's suppose the input irq lines are called : - i_sa1111 - i_lan91x - i_mmc_cd Let's suppose the status register for each irq line is called : - status_sa1111 - status_lan91x - status_mmc_cd Let's suppose the interrupt mask for each irq line is called : - irqen_sa1111 - irqen_lan91x - irqen_mmc_cd Let's suppose the output irq line, connected to GPIO0 is called : - o_gpio0 The behavior is as follows : - o_gpio0 = not((status_sa1111 & irqen_sa1111) | (status_lan91x & irqen_lan91x) | (status_mmc_cd & irqen_mmc_cd)) => this is a N-to-1 NOR gate and multiple AND gates - irqen_* is exactly as programmed by a write to the FPGA - status_* behavior is governed by a bi-stable D flip-flop => on next FPGA clock : - if i_xxx is high, status_xxx becomes 1 - if i_xxx is low, status_xxx remains as it is - if software sets status_xxx to 0, the D flip-flop is reset => status_xxx becomes 0 => on next FPGA clock cycle, if i_xxx is high, status_xxx becomes 1 again Fixes: fc9e38c0f4d3 ("ARM: pxa: lubbock: use new pxa_cplds driver") Reported-by: Russell King Signed-off-by: Robert Jarzmik Signed-off-by: Greg Kroah-Hartman commit 56b47c0b7968f71ad971fc3f600bc5f1dc8d8ee8 Author: Christophe Leroy Date: Mon Sep 19 12:58:54 2016 +0200 powerpc: Fix usage of _PAGE_RO in hugepage commit 6b8cb66a6a7cc182b47da6a0a1d4e5da324c0695 upstream. On some CPUs like the 8xx, _PAGE_RW hence _PAGE_WRITE is defined as 0 and _PAGE_RO has to be set when a page is not writable _PAGE_RO is defined by default in pte-common.h, however BOOK3S/64 doesn't include that file so _PAGE_RO has to be defined explicitly in book3s/64/pgtable.h Fixes: a7b9f671f2d14 ("powerpc32: adds handling of _PAGE_RO") Signed-off-by: Christophe Leroy Reviewed-by: Aneesh Kumar K.V Signed-off-by: Michael Ellerman Signed-off-by: Greg Kroah-Hartman commit c80b599ab5d40c6aea170fd670b4802758623e54 Author: Pan Xinhui Date: Thu Dec 10 15:30:02 2015 +0800 powerpc/nvram: Fix an incorrect partition merge commit 11b7e154b132232535befe51c55db048069c8461 upstream. When we merge two contiguous partitions whose signatures are marked NVRAM_SIG_FREE, We need update prev's length and checksum, then write it to nvram, not cur's. So lets fix this mistake now. Also use memset instead of strncpy to set the partition's name. It's more readable if we want to fill up with duplicate chars . Fixes: fa2b4e54d41f ("powerpc/nvram: Improve partition removal") Signed-off-by: Pan Xinhui Signed-off-by: Michael Ellerman Signed-off-by: Greg Kroah-Hartman commit d4d5154f8aa5fbd2862990a1e81e73cf3a56f4fe Author: Cyril Bur Date: Fri Sep 23 16:18:09 2016 +1000 powerpc: Add check_if_tm_restore_required() to giveup_all() commit b0f16b46988fde02a1e32078f66a3059d7e53bfc upstream. giveup_all() causes FPU/VMX/VSX facilities to be disabled in a threads MSR. If the thread performing the giveup was transactional, the kernel must record which facilities were in use before the giveup as the thread must have these facilities re-enabled on return to userspace. >From process.c: /* * This is called if we are on the way out to userspace and the * TIF_RESTORE_TM flag is set. It checks if we need to reload * FP and/or vector state and does so if necessary. * If userspace is inside a transaction (whether active or * suspended) and FP/VMX/VSX instructions have ever been enabled * inside that transaction, then we have to keep them enabled * and keep the FP/VMX/VSX state loaded while ever the transaction * continues. The reason is that if we didn't, and subsequently * got a FP/VMX/VSX unavailable interrupt inside a transaction, * we don't know whether it's the same transaction, and thus we * don't know which of the checkpointed state and the transactional * state to use. */ Calling check_if_tm_restore_required() will set TIF_RESTORE_TM and save the MSR if needed. Fixes: c208505 ("powerpc: create giveup_all()") Signed-off-by: Cyril Bur Signed-off-by: Michael Ellerman Signed-off-by: Greg Kroah-Hartman commit 613036d9e91990f2043130ff8f78fd770432b3de Author: Cyril Bur Date: Fri Sep 23 16:18:08 2016 +1000 powerpc: Always restore FPU/VEC/VSX if hardware transactional memory in use commit dc16b553c949e81f37555777dc7bab66d78285a7 upstream. Comment from arch/powerpc/kernel/process.c:967: If userspace is inside a transaction (whether active or suspended) and FP/VMX/VSX instructions have ever been enabled inside that transaction, then we have to keep them enabled and keep the FP/VMX/VSX state loaded while ever the transaction continues. The reason is that if we didn't, and subsequently got a FP/VMX/VSX unavailable interrupt inside a transaction, we don't know whether it's the same transaction, and thus we don't know which of the checkpointed state and the ransactional state to use. restore_math() restore_fp() and restore_altivec() currently may not restore the registers. It doesn't appear that this is more serious than a performance penalty. If the math registers aren't restored the userspace thread will still be run with the facility disabled. Userspace will not be able to read invalid values. On the first access it will take an facility unavailable exception and the kernel will detected an active transaction, at which point it will abort the transaction. There is the possibility for a pathological case preventing any progress by transactions, however, transactions are never guaranteed to make progress. Fixes: 70fe3d9 ("powerpc: Restore FPU/VEC/VSX if previously used") Signed-off-by: Cyril Bur Signed-off-by: Michael Ellerman Signed-off-by: Greg Kroah-Hartman commit d7baac249b8309948ccfe12ad104fb14982c9692 Author: Johannes Thumshirn Date: Wed Aug 3 15:00:18 2016 +0200 mpt3sas: Don't spam logs if logging level is 0 commit 0d667f72b2a20bbac72bec0ab11467fc70bb0f1f upstream. In _scsih_io_done() we test if the ioc->logging_level does _not_ have the MPT_DEBUG_REPLY bit set and if it hasn't we print the debug messages. This unfortunately is the wrong way around. Note, the actual bug is older than af0094115 but this commit removed the CONFIG_SCSI_MPT3SAS_LOGGING Kconfig option which hid the bug. Fixes: af0094115 'mpt2sas, mpt3sas: Remove SCSI_MPTXSAS_LOGGING entry from Kconfig' Signed-off-by: Johannes Thumshirn Acked-by: Chaitra P B Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman commit cab7ff65144217d4191091ea1745aa24aa1ebac2 Author: John Crispin Date: Mon Sep 12 11:36:55 2016 +0200 pinctrl: qcom: fix masking of pinmux functions commit 6bcf3f63394b9c4f133e4499349d786d7f531473 upstream. The following commit introduced a regression by not properly masking the calculated value. Fixes: 47a01ee9a6c3 ("pinctrl: qcom: Clear all function selection bits") Signed-off-by: John Crispin Reviewed-by: Bjorn Andersson Reviewed-by: Stephen Boyd Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman commit 4cf6e0bbccca0627e146b0ac83c2f6e0c041b6c8 Author: Chen-Yu Tsai Date: Sat Aug 27 15:59:50 2016 +0800 ARM: dts: sun9i: Add missing #interrupt-cells to R_PIO pinctrl device node commit 06ad11be7a9e13499ff8e55e46f09d22f9ee6fc0 upstream. The R_PIO device node is missing #interrupt-cells, which causes interrupt parsing to fail to match it as a valid interrupt controller. Add #interrupt-cells to it. Also remove the unnecesary #address-cells and #size-cells. Fixes: 1ac56a6da9e1 ("ARM: dts: sun9i: Add A80 R_PIO pin controller device node") Signed-off-by: Chen-Yu Tsai Signed-off-by: Maxime Ripard Signed-off-by: Greg Kroah-Hartman commit 935c26d0fc449ed8803c27c340a3cc552961edab Author: Luca Coelho Date: Wed Sep 14 11:54:36 2016 +0300 iwlwifi: mvm: bail out if CTDP start operation fails commit 75cfe338b8a6fadaa28879a969047554701a7589 upstream. We were assigning the return value of iwl_mvm_ctdp_command() to a variable, but never checking it. If this command fails, we should not allow the interface up process to proceed, since it is potentially dangerous to ignore thermal management requirements. Fixes: commit 5c89e7bc557e ("iwlwifi: mvm: add registration to cooling device") Signed-off-by: Luca Coelho Signed-off-by: Greg Kroah-Hartman commit e1a322b9dab0280f5bd8f7e00e81d7ecee6c2b7a Author: Sara Sharon Date: Thu Aug 18 20:14:38 2016 +0300 iwlwifi: mvm: disable P2P queue on mac context release commit 341d7eb8223bdd48bdf75729487a2de5e01623b3 upstream. AP queue is properly released, but P2P queue isn't. Fixes: commit 4c965139a3cd ("iwlwifi: mvm: support p2p device frames tx on dqa queue #2") Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Greg Kroah-Hartman commit 4dfdaf3433a8d9d5c418e8dfebe74eb0414a974d Author: Sara Sharon Date: Mon Aug 8 13:07:01 2016 +0300 iwlwifi: mvm: support BAR in reorder buffer commit 9a73a7d24d51eaf9e43c771c53cf7b594e5b5334 upstream. On default queue we will not receive frame release notification, but the BAR itself. Upon receiving the BAR driver should look at the NSSN and adjust window accordingly. Fixes: b915c10174fb ("iwlwifi: mvm: add reorder buffer per queue") Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Greg Kroah-Hartman commit 3eb8b9e6f5c1f38e159e7853a0d9a44b8d8eac8e Author: Liad Kaufman Date: Thu Jul 7 13:25:59 2016 +0300 iwlwifi: mvm: free reserved queue on STA removal commit a0315dea9091d1ebc1534f6129b3fc9942b8ca99 upstream. When a STA is removed in DQA mode, if no traffic went through its reserved queue, the txq continues to be marked as reserved and no STA can use it. Make sure that in such a case the reserved queue is marked as free when the STA is removed. Fixes: commit 24afba7690e4 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of queues") Signed-off-by: Liad Kaufman Signed-off-by: Luca Coelho Signed-off-by: Greg Kroah-Hartman commit e294beae968b4a5615f3219c77cd2d9cb148bcd3 Author: Sara Sharon Date: Thu Jun 30 16:14:02 2016 +0300 iwlwifi: mvm: call a different txq_enable function commit ca3b9c6b6d4db9a8ba5fc8b95664e75468c59f9f upstream. Since the SCD_QUEUE_CFG command was introduced the driver calls iwl_trans_txq_enable_cfg() with a NULL for scd_cfg parameter. This makes the transport avoid writing to the SCD pointers, since it can cause races with firmware, which is also accessing the registers. The transport only updates the write pointer in that case. Fix a wrong call to iwl_trans_txq_enable() which caused a scd_cfg parameter to be sent to transport, resulting with an access to SCD registers. Fixes: 58f2cc57dc6a ("iwlwifi: mvm: support dqa-mode scd queue redirection") Signed-off-by: Sara Sharon Signed-off-by: Luca Coelho Signed-off-by: Greg Kroah-Hartman commit c8058c456d48b6a12d6ae1aff055473ed68dbe2a Author: Liad Kaufman Date: Thu Jul 7 11:00:26 2016 +0300 iwlwifi: mvm: fix pending frames tracking on tx resp commit 7585c354637bb003ce612dd22f5047c015545ef4 upstream. In iwl_mvm_rx_tx_cmd_single(), when checking if a given TID is aggregated, the driver doesn't check whether or not the queue itself can be aggregated. For example, a management queue might be marked as aggregated if TID 0 is aggregated on a (different) data queue. Make sure that mgmt frames are sent with TID IWL_TID_NON_QOS, and in this way make sure no mixups of this sort happen. Fixes: commit 24afba7690e4 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of queues") Signed-off-by: Liad Kaufman Signed-off-by: Luca Coelho Signed-off-by: Greg Kroah-Hartman commit 8a0b49af92c655b72f37bb445a3b8748de1160dc Author: Haim Dreyfuss Date: Tue Aug 2 15:28:23 2016 +0300 iwlwifi: check for valid ethernet address provided by OEM commit a6c934b364948cd4de5bd9ab055bb65206ec70f3 upstream. In 9000 family products we added an option to let the OEM fuse the mac address via registers. If these registers are zeroed we use the OTP address instead. Make sure that the address provided by the OEM is valid and, if not, fall back to the OTP address as well. Fixes: commit 17c867bfe89b ("iwlwifi: add support for getting HW address from CSR") Signed-off-by: Haim Dreyfuss Signed-off-by: Luca Coelho Signed-off-by: Greg Kroah-Hartman commit 6bda3c71202ed0cd80557afa27facad015982fca Author: Arnaldo Carvalho de Melo Date: Thu Sep 1 11:00:23 2016 -0300 perf symbols: Fixup symbol sizes before picking best ones commit 432746f8e0b6a82ba832b771afe31abd51af6752 upstream. When we call symbol__fixup_duplicate() we use algorithms to pick the "best" symbols for cases where there are various functions/aliases to an address, and those check zero size symbols, which, before calling symbol__fixup_end() are _all_ symbols in a just parsed kallsyms file. So first fixup the end, then fixup the duplicates. Found while trying to figure out why 'perf test vmlinux' failed, see the output of 'perf test -v vmlinux' to see cases where the symbols picked as best for vmlinux don't match the ones picked for kallsyms. Cc: Anton Blanchard Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Wang Nan Fixes: 694bf407b061 ("perf symbols: Add some heuristics for choosing the best duplicate symbol") Link: http://lkml.kernel.org/n/tip-rxqvdgr0mqjdxee0kf8i2ufn@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman commit a2ce058171ec65357d7563d22b3a985a4c267acb Author: Arnaldo Carvalho de Melo Date: Thu Sep 1 10:56:06 2016 -0300 perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too commit c97b40e4d15f13a36cd037d598e45cbe9e1e5757 upstream. We can allow aliases to be kept, but we were checking this just when loading vmlinux files, be consistent, do it for any symbol table loading code that calls symbol__fixup_duplicate() by making this function check .allow_aliases instead. Cc: Adrian Hunter Cc: David Ahern Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Wang Nan Fixes: 680d926a8cb0 ("perf symbols: Allow symbol alias when loading map for symbol name") Link: http://lkml.kernel.org/n/tip-z0avp0s6cfjckc4xj3pdfjdz@git.kernel.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman commit bd1a717d462bc997f7c368aaa17843389d55c8e5 Author: Namhyung Kim Date: Tue Sep 13 16:45:49 2016 +0900 perf ui/stdio: Always reset output width for hierarchy commit 9a6ad25b5a2026ba1399abc879ec623957867e79 upstream. When the --hierarchy option is used, each entry has its own hpp_list to show the result. But it is not updating the width of each column for perf-top. The perf-report command has no problem since it resets it during header display. $ sudo perf top --hierarchy --stdio PerfTop: 160 irqs/sec kernel:38.8% exact: 100.0% [4000Hz cycles:pp], (all, 12 CPUs) ---------------------------------------------------------------------- 52.32% perf 24.74% [.] __symbols__insert 5.62% [.] rb_next 5.14% [.] dso__load_sym Move the code into hists__fprintf() so that it can be called always. Also it'd be better to put similar code together. Signed-off-by: Namhyung Kim Tested-by: Arnaldo Carvalho de Melo Cc: Andi Kleen Cc: Jiri Olsa Cc: Peter Zijlstra Fixes: 1b2dbbf41a0f ("perf hists: Use own hpp_list for hierarchy mode") Link: http://lkml.kernel.org/r/20160913074552.13284-5-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman commit 37ae01ab393faea79974405fbdfbde96b7fac998 Author: Namhyung Kim Date: Tue Sep 20 14:30:23 2016 +0900 perf ui/tui: Reset output width for hierarchy commit 5ff3e7a224d40f9dd73625b91377787034a8b35e upstream. When --hierarchy option is used, each entry has its own hpp_list to show the result. But it missed to update width of each column. Before: - 46.29% 48.12% netctl-auto + 31.44% 29.25% [kernel.vmlinux] + 8.52% 11.55% libc-2.22.so + 5.19% 6.91% bash + 10.75% 11.83% wpa_cli + 8.25% 2.23% swapper + 6.45% 5.40% tr + 4.81% 8.09% awk + 4.15% 2.85% firefox + 3.86% 2.53% sh After: - 46.29% 48.12% netctl-auto + 31.44% 29.25% [kernel.vmlinux] + 8.52% 11.55% libc-2.22.so + 5.19% 6.91% bash + 10.75% 11.83% wpa_cli + 8.25% 2.23% swapper + 6.45% 5.40% tr + 4.81% 8.09% awk + 4.15% 2.85% firefox + 3.86% 2.53% sh Committer note: Full testing instructions: 1) Record with an event group: $ perf record -e '{cycles,instructions}' make -j4 2) Use report in hierarchy mode, to get a few expanded trees on the same screen, use --percent-limit: $ perf report --hierarchy --percent-limit 0.5 Samples: 103K of event 'anon group { cycles:u, instructions:u }', Event count (approx.): 57317631725 Overhead Command / Shared Object / Symbol ◆ - 58.89% 55.12% cc1 ▒ - 50.26% 48.10% cc1 ▒ 3.61% 5.13% [.] _cpp_lex_token ▒ 2.58% 0.78% [.] ht_lookup_with_hash ▒ 1.31% 1.30% [.] ggc_internal_alloc ▒ 1.08% 2.25% [.] get_combined_adhoc_loc ▒ 1.01% 1.95% [.] ira_init ▒ 0.96% 1.78% [.] linemap_position_for_column ▒ 0.65% 1.01% [.] cpp_get_token_with_location ▒ - 7.52% 6.58% libc-2.23.so ▒ 1.70% 1.78% [.] _int_malloc ▒ 0.69% 0.75% [.] _int_free ▒ 0.67% 0.42% [.] malloc_consolidate ▒ - 0.58% 0.42% ld-2.23.so ▒ no entry >= 0.50% ▒ - 0.52% 0.03% [kernel.vmlinux] ▒ no entry >= 0.50% ▒ Signed-off-by: Namhyung Kim Acked-by: Jiri Olsa Cc: Andi Kleen Cc: Peter Zijlstra Fixes: 1b2dbbf41a0f ("perf hists: Use own hpp_list for hierarchy mode") Link: http://lkml.kernel.org/r/20160920053025.13989-1-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman commit d1fe9594411c7e744451b61600ff2901446458f3 Author: Ravi Bangoria Date: Wed Aug 31 13:33:11 2016 +0530 perf powerpc: Fix build-test failure commit 25b8592e912f085ce2ff736a2927584ddeab238c upstream. 'make -C tools/perf build-test' is failing with below log for poewrpc. In file included from /tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf.h:15:0, from util/cpumap.h:8, from util/env.c:1: /tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf-sys.h:23:56: fatal error: ../../arch/powerpc/include/uapi/asm/unistd.h: No such file or directory compilation terminated. I bisected it and found it's failing from commit ad430729ae00 ("Remove: kernel unistd*h files from perf's MANIFEST, not used"). Header file '../../arch/powerpc/include/uapi/asm/unistd.h' is included only for powerpc in tools/perf/perf-sys.h. By looking closly at commit history, I found little weird thing: Commit f2d9cae9ea9e ("perf powerpc: Use uapi/unistd.h to fix build error") replaced 'asm/unistd.h' with 'uapi/asm/unistd.h' Commit d2709c7ce4c5 ("perf: Make perf build for x86 with UAPI disintegration applied") removes all arch specific 'uapi/asm/unistd.h' for all archs and adds generic . Commit f0b9abfb0446 ("Merge branch 'linus' into perf/core") again includes 'uapi/asm/unistd.h' for powerpc. Don't know how exactly this happened as this change is not part of commit also. Signed-off-by: Ravi Bangoria Cc: Alexander Shishkin Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1472630591-5089-1-git-send-email-ravi.bangoria@linux.vnet.ibm.com Fixes: ad430729ae00 ("Remove: kernel unistd*h files from perf's MANIFEST, not used") Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman commit fb743e2e48020362b57d8363fc000c5276486525 Author: Namhyung Kim Date: Mon Sep 12 15:19:52 2016 +0900 perf hists browser: Fix event group display commit d9ea48bc4e7cc297ca1073fa3f90ed80d964b7b4 upstream. Milian reported that the event group on TUI shows duplicated overhead. This was due to a bug on calculating hpp->buf position. The hpp_advance() was called from __hpp__slsmg_color_printf() on TUI but it's already called from the hpp__call_print_fn macro in __hpp__fmt(). The end result is that the print function returns number of bytes it printed but the buffer advanced twice of the length. This is generally not a problem since it doesn't need to access the buffer again. But with event group, overhead needs to be printed multiple times and hist_entry__snprintf_alignment() tries to fill the space with buffer after it printed. So it (brokenly) showed the last overhead again. The bug was there from the beginning, but I think it's only revealed when the alignment function was added. Reported-by: Milian Wolff Signed-off-by: Namhyung Kim Cc: Andi Kleen Cc: Jiri Olsa Cc: Peter Zijlstra Fixes: 89fee7094323 ("perf hists: Do column alignment on the format iterator") Link: http://lkml.kernel.org/r/20160912061958.16656-2-namhyung@kernel.org Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman commit 1b1622138972ba69dbba557aae06f0d4e3c84b3d Author: Wang Nan Date: Wed Sep 28 03:58:46 2016 +0000 perf data: Fix building in 32 bit platform with libbabeltrace commit f2c8852e6e990fcab0d9e68de9d86e5fbea0b5dc upstream. On ARM32 building it report following error when we build with libbabeltrace: util/data-convert-bt.c: In function 'add_bpf_output_values': util/data-convert-bt.c:440:3: error: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'unsigned int' [-Werror=format] cc1: all warnings being treated as errors Fix it by changing %lu to %zu. Signed-off-by: Wang Nan Cc: Jiri Olsa Cc: Zefan Li Cc: pi3orama@163.com Fixes: 6122d57e9f7c ("perf data: Support converting data from bpf_perf_event_output()") Link: http://lkml.kernel.org/r/1475035126-146587-1-git-send-email-wangnan0@huawei.com Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman commit 7f2c95a48dbd2ae754c7c6bc736ada6476852f26 Author: Geert Uytterhoeven Date: Fri Aug 12 14:37:54 2016 +0200 clk: divider: Fix clk_divider_round_rate() to use clk_readl() commit 2cf9a57811bddb6fa6b0f8d7376da164d5534813 upstream. clk-divider uses clk_readl()/clk_writel() everywhere, except in clk_divider_round_rate(), where plain readl() is used. Change this to clk_readl(), as it makes a difference on powerpc. Fixes: e6d5e7d90be92cee ("clk-divider: Fix READ_ONLY when divider > 1") Signed-off-by: Geert Uytterhoeven Reviewed-by: James Hogan Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 03ca3d38640afba6695f9366ee16f2ab56a4c7e3 Author: Jean-Francois Moine Date: Wed Aug 24 08:32:51 2016 +0200 clk: core: Force setting the phase delay when no change commit 3174b0c9a62bb3738b4a2a506b8a075d4430e353 upstream. This patch reverts commit 023bd7166be0 ("clk: skip unnecessary set_phase if nothing to do"), fixing two problems: * in some SoCs, the hardware phase delay depends on the rate ratio of the clock and its parent. So, changing this ratio may imply to set new hardware values, even if the logical delay is the same. * when the delay was the same as previously, an error was returned. Signed-off-by: Jean-Francois Moine Fixes: 023bd7166be0 ("clk: skip unnecessary set_phase if nothing to do") Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 47e14015b33ca41f6ec233e0bc425954ee81f7e6 Author: Stephen Boyd Date: Mon Aug 15 14:32:23 2016 -0700 clk: Return errors from clk providers in __of_clk_get_from_provider() commit f155d15b64e36b45ca89e3521fe0c1ccad5e5ff0 upstream. Before commit 0861e5b8cf80 (clk: Add clk_hw OF clk providers, 2016-02-05) __of_clk_get_from_provider() would return an error pointer of the provider's choosing if there was a provider registered and EPROBE_DEFER otherwise. After that commit, it would return EPROBE_DEFER regardless of whether or not the provider returned an error. This is odd and can lead to behavior where clk consumers keep probe deferring when they should be seeing some other error. Let's restore the previous behavior where we only return EPROBE_DEFER when there isn't a provider in our of_clk_providers list. Otherwise, return the error from the last provider we find that matches the node. Reported-by: Masahiro Yamada Fixes: 0861e5b8cf80 ("clk: Add clk_hw OF clk providers") Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 40213c827c91f7fe9ff4f04c722cbb425ccda594 Author: Tang Yuantian Date: Mon Aug 15 15:28:20 2016 +0800 clk: qoriq: fix a register offset error commit 8964193f6bfda5c4cf14eedb7e94892c1f1c34f0 upstream. The offset of Core Cluster clock control/status register on cluster group V3 version is different from others, and should be plus 0x70000. Signed-off-by: Tang Yuantian Reviewed-by: Scott Wood Fixes: 9e19ca2f627e ("clk: qoriq: Add ls2080a support.") Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit ee602d2c4966487d5ac64fc90a31f875ac437766 Author: Srinivas Kandagatla Date: Thu Aug 25 12:28:07 2016 +0100 clk: qcom: select GDSC for msm8996 gcc and mmcc commit 6d91f2c0141330b919ae4d13395f38c341469564 upstream. This patch selects QCOM_GDSC Kconfig for msm8996 GCC and MMCC clock controllers, as these provide some of the gdscs on the SOC. Also selecting this config will make it align with other drivers which do the same. Signed-off-by: Srinivas Kandagatla Fixes: 52111672f791 ("clk: qcom: gdsc: Add GDSCs in msm8996 GCC") Fixes: 7e824d507909 ("clk: qcom: gdsc: Add mmcc gdscs for msm8996 family") Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit b8ccb5004837bd1692ae3656ba9524ad8626967c Author: Srinivas Kandagatla Date: Thu Aug 25 12:20:46 2016 +0100 clk: gcc-msm8996: Fix pcie 2 pipe register offset commit ce61966c05f276294b6be04d1765ad0d827ddefd upstream. This patch corrects the register offset for pcie2 pipe clock. Offset according to datasheet is 0x6e018 instead of 0x6e108. Signed-off-by: Srinivas Kandagatla Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver") Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 6b207c78fe60bb56f187f3c68a9387bd082bcb3e Author: Eric Anholt Date: Wed Jun 1 12:05:36 2016 -0700 clk: bcm2835: Skip PLLC clocks when deciding on a new clock parent commit 67615c588a059b731df9d019edc3c561d8006ec9 upstream. If the firmware had set up a clock to source from PLLC, go along with it. But if we're looking for a new parent, we don't want to switch it to PLLC because the firmware will force PLLC (and thus the AXI bus clock) to different frequencies during over-temp/under-voltage, without notification to Linux. On my system, this moves the Linux-enabled HDMI state machine and DSI1 escape clock over to plld_per from pllc_per. EMMC still ends up on pllc_per, because the firmware had set it up to use that. Signed-off-by: Eric Anholt Fixes: 41691b8862e2 ("clk: bcm2835: Add support for programming the audio domain clocks") Acked-by: Martin Sperl Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 94148899cae679202a20afd70123e89172bbafff Author: Sascha Silbe Date: Tue Sep 20 19:09:07 2016 +0200 s390/con3270: fix insufficient space padding commit 6cd997db911f28f2510b771691270c52b63ed2e6 upstream. con3270 contains an optimisation that reduces the amount of data to be transmitted to the 3270 terminal by putting a Repeat to Address (RA) order into the data stream. The RA order itself takes up space, so con3270 only uses it if there's enough space left in the line buffer. Otherwise it just pads out the line manually. For lines that were _just_ short enough that the RA order still fit in the line buffer, the line was instead padded with an insufficient amount of spaces. This was caused by examining the size of the allocated line buffer rather than the length of the string to be displayed. For con3270_cline_end(), we just compare against the line length. For con3270_update_string() however that isn't available anymore, so we check whether the Repeat to Address order is present. Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git) Tested-by: Jing Liu Tested-by: Yang Chen Signed-off-by: Sascha Silbe Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit 6b6dd42617aa23cc35e69abed8b18230d5c947cd Author: Sascha Silbe Date: Thu Aug 11 21:34:54 2016 +0200 s390/con3270: fix use of uninitialised data commit c14f2aac7aa147861793eed9f41f91dd530f0be1 upstream. con3270 contains an optimisation that reduces the amount of data to be transmitted to the 3270 terminal by putting a Repeat to Address (RA) order into the data stream. The RA order itself takes up space, so con3270 only uses it if there's enough space left in the line buffer. Otherwise it just pads out the line manually. For lines too long to include the RA order, one byte was left uninitialised. This was caused by an off-by-one bug in the loop that pads out the line. Since the buffer is allocated from a common pool, the single byte left uninitialised contained some previous buffer content. Usually this was just a space or some character (which can result in clutter but is otherwise harmless). Sometimes, however, it was a Repeat to Address order, messing up the entire screen layout and causing the display to send the entire buffer content on every keystroke. Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git) Reported-by: Liu Jing Tested-by: Jing Liu Tested-by: Yang Chen Signed-off-by: Sascha Silbe Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit a1ad62a1ca2a01bbf891cafe1b92f7b5d095f10d Author: Sebastian Ott Date: Wed Sep 28 13:36:19 2016 +0200 s390/cio: fix accidental interrupt enabling during resume commit d53c51f26145657aa7c55fa396f93677e613548d upstream. Since commit 9f3d6d7 chsc_get_channel_measurement_chars is called with interrupts disabled during resume from hibernate. Since this function used spin_unlock_irq, interrupts have been enabled accidentally. Fix this by using the irqsave variant. Since we can't guarantee the IRQ-enablement state for all (future/ external) callers, change the locking in related functions to prevent similar bugs in the future. Fixes: 9f3d6d7 ("s390/cio: update measurement characteristics") Signed-off-by: Sebastian Ott Reviewed-by: Peter Oberparleiter Signed-off-by: Martin Schwidefsky Signed-off-by: Greg Kroah-Hartman commit f5ed7c00278a33d323ddbf5684bb69e7709ede14 Author: Thomas Hellstrom Date: Mon Oct 10 11:06:45 2016 -0700 drm/vmwgfx: Avoid validating views on view destruction commit a19440304db2d97aed5cee9bfa5017c98d2348bf upstream. When a view destruction command was present in the command stream, the view was validated to avoid a device error. That caused excessive and unnecessary validations of views, surfaces and mobs on view destruction. Replace this with a new relocation type that patches the view destruction command to a NOP if the view is not present in the device after the execbuf validation sequence. Also add checks for the member size of the vmw_res_relocation struct. Fixes sporadic command submission errors on google-earth exit. Reported-by: Brian Paul Signed-off-by: Thomas Hellstrom Reviewed-by: Brian Paul Reviewed-by: Sinclair Yeh Signed-off-by: Sinclair Yeh Signed-off-by: Greg Kroah-Hartman commit ae1d0b6ec8ec9564ff80b63c73d167fc87e8fb28 Author: Gerald Schaefer Date: Fri Oct 7 17:01:13 2016 -0700 mm/hugetlb: improve locking in dissolve_free_huge_pages() commit eb03aa008561004257900983193d024e57abdd96 upstream. For every pfn aligned to minimum_order, dissolve_free_huge_pages() will call dissolve_free_huge_page() which takes the hugetlb spinlock, even if the page is not huge at all or a hugepage that is in-use. Improve this by doing the PageHuge() and page_count() checks already in dissolve_free_huge_pages() before calling dissolve_free_huge_page(). In dissolve_free_huge_page(), when holding the spinlock, those checks need to be revalidated. Link: http://lkml.kernel.org/r/20160926172811.94033-4-gerald.schaefer@de.ibm.com Signed-off-by: Gerald Schaefer Acked-by: Michal Hocko Acked-by: Naoya Horiguchi Cc: "Kirill A . Shutemov" Cc: Vlastimil Babka Cc: Mike Kravetz Cc: "Aneesh Kumar K . V" Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: Rui Teng Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit 8f858254414942cff6fcdc6a91cfbb4b81dc9036 Author: Gerald Schaefer Date: Fri Oct 7 17:01:10 2016 -0700 mm/hugetlb: check for reserved hugepages during memory offline commit 082d5b6b60e9f25e1511557fcfcb21eedd267446 upstream. In dissolve_free_huge_pages(), free hugepages will be dissolved without making sure that there are enough of them left to satisfy hugepage reservations. Fix this by adding a return value to dissolve_free_huge_pages() and checking h->free_huge_pages vs. h->resv_huge_pages. Note that this may lead to the situation where dissolve_free_huge_page() returns an error and all free hugepages that were dissolved before that error are lost, while the memory block still cannot be set offline. Fixes: c8721bbb ("mm: memory-hotplug: enable memory hotplug to handle hugepage") Link: http://lkml.kernel.org/r/20160926172811.94033-3-gerald.schaefer@de.ibm.com Signed-off-by: Gerald Schaefer Acked-by: Michal Hocko Acked-by: Naoya Horiguchi Cc: "Kirill A . Shutemov" Cc: Vlastimil Babka Cc: Mike Kravetz Cc: "Aneesh Kumar K . V" Cc: Martin Schwidefsky Cc: Heiko Carstens Cc: Rui Teng Cc: Dave Hansen Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman commit eec435b0156d930153375318dd943ed2a5abffdd Author: Arnd Bergmann Date: Sat Sep 3 01:22:02 2016 +0200 dmaengine: ipu: remove bogus NO_IRQ reference commit 86c7e6836479c4045a9a81ed5ea76c51d719f9c1 upstream. A workaround for a warning introduced a use of the NO_IRQ macro that should have been gone for a long time. It is clear from the code that the value cannot actually be used, but apparently there was a configuration at some point that caused a warning, so instead of just reverting that patch, this rearranges the code in a way that the warning cannot reappear. Signed-off-by: Arnd Bergmann Fixes: 6ef41cf6f721 ("dmaengine :ipu: change ipu_irq_handler() to remove compile warning") Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman commit 19e92c58d65f288008b60ba6b66aef17cc85d7e0 Author: Georges Savoundararadj Date: Wed Sep 7 18:38:15 2016 -0700 power: bq24257: Fix use of uninitialized pointer bq->charger commit 0610735928ee47870e083d5901caa371089216f1 upstream. bq->charger is initialized in bq24257_power_supply_init. Therefore, bq24257_power_supply_init should be called before the registration of the IRQ handler bq24257_irq_handler_thread that calls power_supply_changed(bq->charger). Signed-off-by: Georges Savoundararadj Cc: Aurelien Chanot Cc: Andreas Dannenberg Cc: Sebastian Reichel Cc: David Woodhouse Fixes: 2219a935963e ("power_supply: Add TI BQ24257 charger driver") Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman commit 2ff77df8f246eea8a13a0940e9788a1dfa88d32c Author: Maor Gottlieb Date: Sun Aug 28 14:16:30 2016 +0300 IB/mlx5: Fix steering resource leak commit 7055a29471eebf4b62687944694222635ed44b09 upstream. Fix multicast flow rule leak on adding unicast rule failure. Fixes: 038d2ef87572 ('IB/mlx5: Add flow steering support') Signed-off-by: Maor Gottlieb Signed-off-by: Leon Romanovsky Signed-off-by: Doug Ledford Signed-off-by: Greg Kroah-Hartman commit 2b0a6bd8227b96b412a6ed9446c793aca5602927 Author: Dennis Dalessandro Date: Sun Sep 25 07:41:05 2016 -0700 IB/qib: Remove qpt_mask global commit 84b3adc2430eafd2eb703570075c3c141ea0ff13 upstream. There is no need to have a global qpt_mask as that does not support the multiple chip model which qib has. Instead rely on the value which exists already in the device data (dd). Fixes: 898fa52b4ac3 "IB/qib: Remove qpn, qp tables and related variables from qib" Reviewed-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford Signed-off-by: Greg Kroah-Hartman commit 17338680dc2f710b483581ad9395f76367ac90de Author: Mike Marciniszyn Date: Tue Sep 6 04:36:33 2016 -0700 IB/rdmavt: Correct sparse annotation commit eefa1d8961584c5b76afded94960ca4344bc638b upstream. The __must_hold() is sufficent to correct the sparse context imbalance inside a function. Per Documentation/sparse.txt: __must_hold - The specified lock is held on function entry and exit. Fixes: Commit c0a67f6ba356 ("IB/rdmavt: Annotate rvt_reset_qp()") Reviewed-by: Dennis Dalessandro Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford Signed-off-by: Greg Kroah-Hartman commit 70c13d8a377e0a8addca63a84d913464c1b8cff6 Author: Mike Marciniszyn Date: Tue Sep 6 04:36:53 2016 -0700 IB/hfi1: Move iowait_init() to priv allocate commit 5a648dfad033bf5f945795c4e56ee7577f24f3e9 upstream. The call is misplaced in the reset calldown function and causes issues with lockdep assertions that are to be added. Fixes: Commit a2c2d608957c ("staging/rdma/hfi1: Remove create_qp functionality") Reviewed-by: Ira Weiny Reviewed-by: Dennis Dalessandro Signed-off-by: Mike Marciniszyn Signed-off-by: Dennis Dalessandro Signed-off-by: Doug Ledford Signed-off-by: Greg Kroah-Hartman commit ab48e6f0eb2f81533011395b75a442ab02d3dabd Author: Nicholas Mc Guire Date: Mon Jul 25 21:22:27 2016 +0200 staging: ks7010: declare private functions static commit 9afe11e956766eaac4643adaaf49f223dd536c92 upstream. Private functions in ks_hostif.c can be declared static. Fixes: 13a9930d15b4 ("staging: ks7010: add driver from Nanonote extra-repository") Signed-off-by: Nicholas Mc Guire Reviewed-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman commit 2fe3e8e7be4ff9514b8d19d525ba04712cbfa873 Author: Nicholas Mc Guire Date: Mon Jul 25 21:21:50 2016 +0200 staging: ks7010: fix wait_for_completion_interruptible_timeout return handling commit 9d29f14db1095f52ca00b8162b242d6fce07d19f upstream. wait_for_completion_interruptible_timeout return 0 on timeout and -ERESTARTSYS if interrupted. The check for !wait_for_completion_interruptible_timeout() would report an interrupt as timeout. Further, while HZ/50 will work most of the time it could fail for HZ < 50, so this is switched to msecs_to_jiffies(20). Fixes: 13a9930d15b4 ("staging: ks7010: add driver from Nanonote extra-repository") Signed-off-by: Nicholas Mc Guire Signed-off-by: Greg Kroah-Hartman commit 7da89c6a1db629d723ff5c20b95a3709070cbc9c Author: Larry Finger Date: Sun Jun 5 14:11:19 2016 -0500 staging: r8188eu: Fix scheduling while atomic splat commit 1335a9516d3d52f157ad87456efdd8dc9ae1747b upstream. Commit fadbe0cd5292851608e2e01b91d9295fa287b9fe ("staging: rtl8188eu: Remove rtw_zmalloc(), wrapper for kzalloc()") changed all allocation calls to be GFP_KERNEL even though the original wrapper was testing to determine if the caller was in atomic mode. Most of the mistakes were corrected with commit 33dc85c3c667209c930b2dac5ccbc2a365e06b7a ("staging: r8188eu: Fix scheduling while atomic error introduced in commit fadbe0cd"); however, two kzalloc calls were missed as the call only happens when the driver is shutting down. Fixes: fadbe0cd5292851608e2e01b91d9295fa287b9fe ("staging: rtl8188eu: Remove rtw_zmalloc(), wrapper for kzalloc()") Signed-off-by: Larry Finger Cc: navin patidar Signed-off-by: Greg Kroah-Hartman commit d4f1f2c1b351473667952ac8fea37a8823927cfe Author: Phil Turnbull Date: Fri Sep 2 15:35:31 2016 -0400 staging: sm750fb: Correctly set CLOCK_PHASE bit of display controller. commit 992f961480d23e9ef9e686e512a419efef723523 upstream. Commit 6fba39cf32a3 ("staging: sm750fb: use BIT macro for PANEL_DISPLAY_CTRL single-bit fields") accidentally changed the CLOCK_PHASE logic from '|=' to '=' which clears all the previously set bits. Fixes: 6fba39cf32a3 ("staging: sm750fb: use BIT macro for PANEL_DISPLAY_CTRL single-bit fields") Signed-off-by: Phil Turnbull Signed-off-by: Greg Kroah-Hartman commit 95af24c439d4a246ee309f8cbac5b72f1fe8f895 Author: Arnd Bergmann Date: Thu Sep 15 17:57:40 2016 +0200 staging: android ion/hisi: fix dependencies commit 4a236d01b5e0d7e6f4ee9e6c4056fce10b38e8ad upstream. The newly added Hi6220 Ion code fails to build when the ION_OF helpers are not present: drivers/staging/android/ion/hisilicon/hi6220_ion.o: In function `hi6220_ion_remove': hi6220_ion.c:(.text.hi6220_ion_remove+0x4c): undefined reference to `ion_destroy_platform_data' drivers/staging/android/ion/hisilicon/hi6220_ion.o: In function `hi6220_ion_probe': hi6220_ion.c:(.text.hi6220_ion_probe+0x5c): undefined reference to `ion_parse_dt' hi6220_ion.c:(.text.hi6220_ion_probe+0xf8): undefined reference to `ion_destroy_platform_data' This selects the symbol when needed. Fixes: 2b40182a19bc ("staging: android: ion: Add ion driver for Hi6220 SoC platform") Signed-off-by: Arnd Bergmann Acked-by: Laura Abbott Reviewed-by: Sumit Semwal Signed-off-by: Greg Kroah-Hartman commit 1628f95b6e405370edc9aaba0276359dc4748ab6 Author: Christophe JAILLET Date: Wed Aug 10 07:18:16 2016 +0200 iio: light: us5182d: Add missing error code assignment before test commit 281269f8a0b00f5c95de5158e8595ed51bdb4b0a upstream. It is likely that checking the result of 'pm_runtime_set_active' is expected here. Fixes: f0e5f57d3ac2 ("iio: light: us8152d: Add power management support") Signed-off-by: Christophe JAILLET Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit 4100d32ab5a3df4292db4cda2396b0896bc3facc Author: Colin Ian King Date: Mon Jul 25 23:40:01 2016 +0100 iio: ad5755: fix off-by-one on devnr limit check commit 9d47964bfd471f0dd4c89f28556aec68bffa0020 upstream. The comparison for devnr limits is off-by-one, the current check allows 0 to AD5755_NUM_CHANNELS and the limit should be in fact 0 to AD5755_NUM_CHANNELS - 1. This can lead to an out of bounds write to pdata->dac[devnr]. Fix this by replacing > with >= on the comparison. Signed-off-by: Colin Ian King Fixes: c947459979c6 ("iio: ad5755: add support for dt bindings") Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman commit c1d7471d8f35c403e8a077cea1a0b6e050972fab Author: Takashi Sakamoto Date: Tue Sep 27 07:45:09 2016 +0900 ASoC: sst-bxt-da7219_max98357a: fix obsoleted initializers for array commit 43d443dc257c00ef3a3f940b6abfb7537c4fcbe8 upstream. Sparse reports below warnings. bxt_da7219_max98357a.c:250:9: warning: obsolete array initializer, use C99 syntax bxt_da7219_max98357a.c:275:9: warning: obsolete array initializer, use C99 syntax bxt_da7219_max98357a.c:290:9: warning: obsolete array initializer, use C99 syntax bxt_da7219_max98357a.c:304:9: warning: obsolete array initializer, use C99 syntax bxt_da7219_max98357a.c:317:9: warning: obsolete array initializer, use C99 syntax There's no need to use obsoleted way. This commit fixes it. Fixes: 723bad3fef8b (ASoC: Intel: Add Broxton-P Dialog Maxim machine driver) Signed-off-by: Takashi Sakamoto Acked-by: Vinod Koul Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit ef9c76d87ef4ebe3567845db271a00292f834c9b Author: Takashi Sakamoto Date: Tue Sep 27 07:45:08 2016 +0900 ASoC: sst-bxt-rt298: fix obsoleted initializers for array commit 5919a3898136aae4d2cb4b18b44f70f7b185aa47 upstream. Sparse reports below warnings. bxt_rt298.c:275:9: warning: obsolete array initializer, use C99 syntax bxt_rt298.c:290:9: warning: obsolete array initializer, use C99 syntax bxt_rt298.c:304:9: warning: obsolete array initializer, use C99 syntax bxt_rt298.c:317:9: warning: obsolete array initializer, use C99 syntax bxt_rt298.c:331:9: warning: obsolete array initializer, use C99 syntax bxt_rt298.c:344:9: warning: obsolete array initializer, use C99 syntax bxt_rt298.c:357:9: warning: obsolete array initializer, use C99 syntax There's no need to use obsoleted way. This commit fixes it. Fixes: 76016322ec56 (ASoC: Intel: Add Broxton-P machine driver) Signed-off-by: Takashi Sakamoto Acked-by: Vinod Koul Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit af9f71f5551ab21806fe31d6adbeb3af129159db Author: Chen-Yu Tsai Date: Sat Aug 27 19:28:00 2016 +0800 ASoC: dapm: Fix kcontrol creation for output driver widget commit a3930ed060df4ccf2a06cf0b68738dec3e6ff89a upstream. Commit d88429a695a4 ("ASoC: dapm: Add output driver widget") added the snd_soc_dapm_out_drv ID for the output driver widget, which is the same as the PGA widget, with a later power sequence number. Commit 19a2557b76d6 ("ASoC: dapm: Add kcontrol support for PGAs") then added kcontrol support for PGA widgets, but failed to account for output driver widgets. Attempts to use kcontrols with output driver widgets result in silent failures, with the developer having little idea about what went on. Add snd_soc_dapm_out_drv to the switch/case block under snd_soc_dapm_pga in dapm_create_or_share_kcontrol, since they are essentially the same. Fixes: 19a2557b76d6 (ASoC: dapm: Add kcontrol support for PGAs) Signed-off-by: Chen-Yu Tsai Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 99ae95fc3270af7fa0ef5289ea6580af3b5db6d5 Author: Chen-Yu Tsai Date: Sat Aug 27 19:27:59 2016 +0800 ASoC: dapm: Fix value setting for _ENUM_DOUBLE MUX's second channel commit 071133a209354f39d4e5785d5a6a390e03241841 upstream. The value for the second channel in _ENUM_DOUBLE (double channel) MUXs is not correctly updated, due to using the wrong bit shift. Use the correct bit shift, so both channels toggle together. Fixes: 3727b4968453 (ASoC: dapm: Consolidate MUXs and value MUXs) Signed-off-by: Chen-Yu Tsai Reviewed-by: Charles Keepax Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 4f071ac4a1cdbdf01d5678d9d298013569304333 Author: Chen-Yu Tsai Date: Sat Aug 27 19:27:58 2016 +0800 ASoC: dapm: Fix possible uninitialized variable in snd_soc_dapm_get_volsw() commit 01ad5e7de67b408d9b48b437b06a9938ddf460b5 upstream. If soc_dapm_read() fails, val will be uninitialized, and bogus values will be written later: ret = soc_dapm_read(dapm, reg, &val); val = (val >> shift) & mask; However, the compiler does not give a warning. Return on error before val is really used to avoid this. This is similar to the commit 6912831623c5 ("ASoC: dapm: Fix uninitialized variable in snd_soc_dapm_get_enum_double()") Fixes: ce0fc93ae56e (ASoC: Add DAPM support at the component level) Signed-off-by: Chen-Yu Tsai Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit e668be87d29c526c3f427f51a24011d6af5e93d8 Author: Wei Yongjun Date: Wed Aug 10 13:43:12 2016 +0000 ASoC: topology: Fix error return code in soc_tplg_dapm_widget_create() commit 8ae3ea48df0d746b663057cf0b972a18d0777b7b upstream. Fix to return error code -ENOMEM instead of 0 when failed to create widget, as done elsewhere in this function. Fixes: 8a9782346dcc ("ASoC: topology: Add topology core") Signed-off-by: Wei Yongjun Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit e0a339a90fe8488c3e872eb65f50ed4fc76089c3 Author: Dave Gerlach Date: Tue Sep 20 10:25:40 2016 -0500 hwrng: omap - Only fail if pm_runtime_get_sync returns < 0 commit ad8529fde9e3601180a839867a8ab041109aebb5 upstream. Currently omap-rng checks the return value of pm_runtime_get_sync and reports failure if anything is returned, however it should be checking if ret < 0 as pm_runtime_get_sync return 0 on success but also can return 1 if the device was already active which is not a failure case. Only values < 0 are actual failures. Fixes: 61dc0a446e5d ("hwrng: omap - Fix assumption that runtime_get_sync will always succeed") Signed-off-by: Dave Gerlach Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit fb033dabc8a3efc1b2b902c92a04ff212e281337 Author: Wei Yongjun Date: Sat Sep 17 16:01:22 2016 +0000 crypto: ccp - Fix return value check in ccp_dmaengine_register() commit 7514e3688811e610640ec2201ca14dfebfe13442 upstream. Fix the retrn value check which testing the wrong variable in ccp_dmaengine_register(). Fixes: 58ea8abf4904 ("crypto: ccp - Register the CCP as a DMA resource") Signed-off-by: Wei Yongjun Acked-by: Gary R Hook Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 387994988d9ded00a63cb54cd3289fc06a2a4142 Author: Ard Biesheuvel Date: Thu Sep 1 14:25:42 2016 +0100 crypto: arm/ghash-ce - add missing async import/export commit ed4767d612fd2c39e2c4c69eba484c1219dcddb6 upstream. Since commit 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero"), all ahash drivers are required to implement import()/export(), and must have a non-zero statesize. Fix this for the ARM Crypto Extensions GHASH implementation. Fixes: 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero") Signed-off-by: Ard Biesheuvel Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit eaf23c11fffbcc4f886c1a8346a17d65f8db3525 Author: Romain Perier Date: Tue Aug 9 11:03:18 2016 +0200 crypto: marvell - Update transformation context for each dequeued req commit 09951d83fc58a6f772de09c08e370f6d9970dbb6 upstream. So far, sub part of mv_cesa_int was responsible of dequeuing complete requests, then call the 'cleanup' operation on these reqs and call the crypto api callback 'complete'. The problem is that the transformation context 'ctx' is retrieved only once before the while loop. Which means that the wrong 'cleanup' operation might be called on the wrong type of cesa requests, it can lead to memory corruptions with this message: marvell-cesa f1090000.crypto: dma_pool_free cesa_padding, 5a5a5a5a/5a5a5a5a (bad dma) This commit fixes the issue, by updating the transformation context for each dequeued cesa request. Fixes: commit 85030c5168f1 ("crypto: marvell - Add support for chai...") Signed-off-by: Romain Perier Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 9c1ea6c6313b6b7bb20e3b184f9a7c99209e6220 Author: Ondrej Mosnáček Date: Fri Sep 23 10:47:32 2016 +0200 crypto: gcm - Fix IV buffer size in crypto_gcm_setkey commit 50d2e6dc1f83db0563c7d6603967bf9585ce934b upstream. The cipher block size for GCM is 16 bytes, and thus the CTR transform used in crypto_gcm_setkey() will also expect a 16-byte IV. However, the code currently reserves only 8 bytes for the IV, causing an out-of-bounds access in the CTR transform. This patch fixes the issue by setting the size of the IV buffer to 16 bytes. Fixes: 84c911523020 ("[CRYPTO] gcm: Add support for async ciphers") Signed-off-by: Ondrej Mosnacek Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 1b1e27ab4f7ae68a260047bac33571ee1cd45b5b Author: Romain Perier Date: Tue Aug 9 11:03:19 2016 +0200 crypto: marvell - Don't overwrite default creq->state during initialization commit 57cfda1ac74e58767f6305bd1ea3449177425460 upstream. Currently, in mv_cesa_{md5,sha1,sha256}_init creq->state is initialized before the call to mv_cesa_ahash_init. This is wrong because this function fills creq with zero by using memset, so its 'state' that contains the default DIGEST is overwritten. This commit fixes the issue by initializing creq->state just after the call to mv_cesa_ahash_init. Fixes: commit b0ef51067cb4 ("crypto: marvell/cesa - initialize hash...") Signed-off-by: Romain Perier Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit f163372f569bf80fd3d14bcedb1a31aa1f954a1d Author: Rajkumar Manoharan Date: Fri Sep 2 19:46:10 2016 +0300 ath10k: fix throughput regression in multi client mode commit 18f53fe0f30331e826b075709ed7b26b9283235e upstream. commit 7a0adc83f34d ("ath10k: improve tx scheduling") is causing severe throughput drop in multi client mode. This issue is originally reported in veriwave setup with 50 clients with TCP downlink traffic. While increasing number of clients, the average throughput drops gradually. With 50 clients, the combined peak throughput is decreased to 98 Mbps whereas reverting given commit restored it to 550 Mbps. Processing txqs for every tx completion is causing overhead. Ideally for management frame tx completion, pending txqs processing can be avoided. The change partly reverts the commit "ath10k: improve tx scheduling". Processing pending txqs after all skbs tx completion will yeild enough room to burst tx frames. Fixes: 7a0adc83f34d ("ath10k: improve tx scheduling") Signed-off-by: Rajkumar Manoharan Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman commit 7acf11980844be117549b306e2f2c713b97dcbc1 Author: Ashok Raj Nagarajan Date: Fri Sep 2 10:59:53 2016 +0530 ath10k: fix reporting channel survey data commit 77eb3d693182b4eaa88c6ba406fbb92b1f1bd636 upstream. When user requests for survey dump data, driver is providing wrong survey information. This information we sent is the survey data that we have collected during previous user request. This issue occurs because we request survey dump for wrong channel. With this change, we correctly display the correct and current survey information to userspace. Fixes: fa7937e3d5c2 ("ath10k: update bss channel survey information") Signed-off-by: Ashok Raj Nagarajan Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman commit 4464c51c0cd00b1ef2e4959175b2e1729a1f7452 Author: Ashok Raj Nagarajan Date: Thu Aug 18 15:30:04 2016 +0530 ath10k: fix sending frame in management path in push txq logic commit e4fd726f21cdae0dc9cea6cbfcb7e27f21393f88 upstream. In the wake tx queue path, we are not checking if the frame to be sent takes management path or not. For eg. QOS null func frame coming here will take the management path. Since we are not incrementing the descriptor counter (num_pending_mgmt_tx) w.r.t tx management, on tx completion it is possible to see negative values. When the above counter reaches a negative value, we will not be sending a probe response out. if (is_presp && ar->hw_params.max_probe_resp_desc_thres < htt->num_pending_mgmt_tx) For IPQ4019, max_probe_resp_desc_thres (u32) is 24 is compared against num_pending_mgmt_tx (int) and the above condtions comes true if the counter is negative and we drop the probe response. To avoid this, check on the wake tx queue path as well for the tx path of the frame and increment the appropriate counters Fixes: cac085524cf1 "ath10k: move mgmt descriptor limit handle under mgmt_tx" Signed-off-by: Ashok Raj Nagarajan Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman commit 7cefaa597140d72fe4f900a31c4bab3711b8ab0c Author: Tamizh chelvam Date: Tue Aug 2 16:13:14 2016 +0530 ath10k: Add WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT wmi service commit 64ed5771aca2fcfb8ea440fc679741054011fd7e upstream. WMI_SERVICE_PERIODIC_CHAN_STAT_SUPPORT service has missed in the commit 7e247a9e88dc ("ath10k: add dynamic tx mode switch config support for qca4019"). This patch adds the service to avoid mismatch between host and target. Fixes: 7e247a9e88dc ("ath10k: add dynamic tx mode switch config support for qca4019") Signed-off-by: Tamizh chelvam Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman commit 4b35aad592beae007ce74040a5c4f8a25e30037d Author: Amitkumar Karwar Date: Mon Jul 25 21:21:06 2016 +0530 mwifiex: fix failed to reconnect after interface disabled/enabled commit c8ccf3ade7851054f82bf88f5fcd393a394038a3 upstream. Recent patch "mwifiex: fix NULL pointer" skips extended scan event handling when suspend is in progress. It created a problem for scan after interface disabled/enabled case. This patch solves the problem by checking netif_running() status. Fixes:16d25da94f3d654 ("mwifiex: fix NULL pointer dereference during suspend") Signed-off-by: Amitkumar Karwar Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman commit 1ce213ab6327961ea9c17baa1234a91e8cf8137e Author: Xinming Hu Date: Tue Aug 9 20:20:44 2016 +0530 mwifiex: correct aid value during tdls setup commit b64db1b252e9974a43a51ba083fa7d03e4716167 upstream. AID gets updated during TDLS setup, but modified value isn't reflected in "priv->assoc_rsp_buf". This causes TDLS setup failure. The problem is fixed here. Fixes: 4aff53ef18e4a4 ("mwifiex: parsing aid while receiving..") Signed-off-by: Xinming Hu Signed-off-by: Amitkumar Karwar Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman commit 7243fe67b93832e1c2869be18383c543a544ec1a Author: Jacob Keller Date: Tue Jul 19 16:23:30 2016 -0700 i40e: fix broken i40e_config_rss_aq function commit 776b2e15f8af7900409456292efd45af6de97172 upstream. X722 hardware requires using the admin queue to configure RSS. This function was previously re-written in commit e69ff813af35 ("i40e: rework the functions to configure RSS with similar parameters"). However, the previous refactor did not work correctly for a few reasons (a) it does not check whether seed is NULL before using it, resulting in a NULL pointer dereference [ 402.954721] BUG: unable to handle kernel NULL pointer dereference at (null) [ 402.955568] IP: [] i40e_config_rss_aq.constprop.65+0x2f/0x1c0 [i40e] [ 402.956402] PGD ad610067 PUD accc0067 PMD 0 [ 402.957235] Oops: 0000 [#1] SMP [ 402.958064] Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_filter ebtable_ broute bridge stp llc ebtable_nat ebtables ip6table_mangle ip6table_raw ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv 6 ip6table_security ip6table_filter ip6_tables iptable_mangle iptable_raw iptable_nat nf_conntrack_ipv4_ nf_defrag_ipv4_ nf_nat_ip v4_ nf_nat nf_conntrack iptable_security intel_rapl i86_kg_temp_thermal coretemp kvm_intel kvm irqbypass crct10dif_clMl crc32_ pclMl ghash_clMlni_intel iTCO_wdt iTCO_vendor_support shpchp sb_edac dcdbas pcspkr joydev ipmi_devintf wmi edac_core ipmi_ssif acpi_ad acpi_ower_meter ipmi_si ipmi_msghandler mei_me nfsd lpc_ich mei ioatdma tpm_tis auth_rpcgss tpm nfs_acl lockd grace s unrpc ifs nngag200 i2c_algo_bit drm_kms_helper ttm drm iigbe bnx2x i40e dca mdio ptp pps_core libcrc32c fjes crc32c_intel [ 402.965563] CPU: 22 PID: 2461 Conm: ethtool Not tainted 4.6.0-rc7_1.2-ABNidQ+ #20 [ 402.966719] Hardware name: Dell Inc. PowerEdge R720/0C4Y3R, BIOS 2.5.2 01/28/2015 [ 402.967862] task: ffff880219b51dc0 ti: ffff8800b3408000 task.ti: ffff8800b3408000 [ 402.969046] RIP: 0010:[] [] i40e_config_rss_aq.constprop.65+0x2f/0x1c0 [i40e] [ 402.970339] RSP: 0018:ffff8800b340ba90 EFLAGS: 00010246 [ 402.971616] RAX: 0000000000000000 RBX: ffff88042ec14000 RCX: 0000000000000200 [ 402.972961] RDX: ffff880428eb9200 RSI: 0000000000000000 RDI: ffff88042ec14000 [ 402.974312] RBP: ffff8800b340baf8 R08: ffff880237ada8f0 R09: ffff880428eb9200 [ 402.975709] R10: ffff880428eb9200 R11: 0000000000000000 R12: ffff88042ec2e000 [ 402.977104] R13: ffff88042ec2e000 R14: ffff88042ec14000 R15: ffff88022ea00800 [ 402.978541] FS: 00007f84fd054700(0000) GS:ffff880237ac0000(0000) knlGS:0000000000000000 [ 402.980003] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 402.981508] CR2: 0000000000000000 CR3: 000000003289e000 CR4: 00000000000406e0 [ 402.983028] Stack: [ 402.984578] 0000000002000200 0000000000000000 ffff88023ffeda68 ffff88023ffef000 [ 402.986187] 0000000000000268 ffff8800b340bbf8 ffff88023ffedd80 0000000088ce4f1d [ 402.987844] ffff88042ec14000 ffff88022ea00800 ffff88042ec2e000 ffff88042ec14000 [ 402.989509] Call Trace: [ 402.991200] [] i40e_config_rss+0x11f/0x1c0 [i40e] [ 402.992924] [] i40e_set_rifh+0ic0/0x130 [i40e] [ 402.994684] [] ethtool_set_rifh+0x1f7/0x300 [ 402.996446] [] ? cred_has_capability+0io6b/0x100 [ 402.998203] [] ? selinux_capable+0x12/0x20 [ 402.999968] [] ? security_capable+0x4b/0x70 [ 403.001707] [] dev_ethtool+0x1423/0x2290 [ 403.003461] [] dev_ioctl+0x191/0io630 [ 403.005186] [] ? lru_cache_add+0x3a/0i80 [ 403.006942] [] ? _raw_spin_unlock+0ie/0x20 [ 403.008691] [] sock_do_ioctl+0x45/0i50 [ 403.010421] [] sock_ioctl+0x209/0x2d0 [ 403.012173] [] do_vfs_ioctl+0u4/0io6c0 [ 403.013911] [] SyS_ioctl+0x79/0x90 [ 403.015710] [] entry_SYSCALL_64_fastpath+0x1a/0u4 [ 403.017500] Code: 90 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 89 fb 48 83 ec 40 4c 8b a7 e0 05 00 00 65 48 8b 04 25 28 00 00 00 48 89 45 d0 31 c0 <48> 8b 06 41 0f b7 bc 24 f2 0f 00 00 48 89 45 9c 48 8b 46 08 48 [ 403.021454] RIP [] i40e_config_rss_aq.constprop.65+0x2f/0x1c0 [i40e] [ 403.023395] RSP [ 403.025271] CR2: 0000000000000000 [ 403.027169] ---[ end trace 64561b528cf61cf0 ]--- (b) it does not even bother to use the passed in *lut parameter which defines the requested lookup table. Instead it uses its own round robin table. Fix these issues by re-writing it to be similar to i40e_config_rss_reg and i40e_get_rss_aq. Fixes: e69ff813af35 ("i40e: rework the functions to configure RSS with similar parameters", 2015-10-21) Signed-off-by: Jacob Keller Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher Signed-off-by: Greg Kroah-Hartman commit 0ac5022f56c072d36d5b21aaf9473017a6b4cd70 Author: Dan Carpenter Date: Wed Aug 3 22:01:07 2016 +0300 i40e: remove a stray unlock commit be0cb0a66a1d426f7cd9b170c008725044ae147a upstream. We shifted the locking around a bit but forgot to delete this unlock so now it can unlock twice. Fixes: cd3be169a5ff ('i40e: Move the mutex lock in i40e_client_unregister') Signed-off-by: Dan Carpenter Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher Signed-off-by: Greg Kroah-Hartman commit 07f2b8ab7c38d1784733be864121efc70dc799a9 Author: Wei Yongjun Date: Sat Aug 20 15:25:32 2016 +0000 spi: spi-fsl-dspi: Drop extra spi_master_put in device remove function commit 6999aeabbb703a81a204cb6f9f8f151759a99ac4 upstream. The call sequence spi_alloc_master/spi_register_master/spi_unregister_master is complete; it reduces the device reference count to zero, which and results in device memory being freed. The subsequent call to spi_master_put is unnecessary and results in an access to free memory. Drop it. Fixes: 9298bc727385 ("spi: spi-fsl-dspi: Remove spi-bitbang") Signed-off-by: Wei Yongjun Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman commit 16b127037a8fce38ca5022d8b0de6b695317667b Author: Uwe Kleine-König Date: Thu Sep 8 11:30:21 2016 +0200 ARM: clk-imx35: fix name for ckil clk commit fcff03813a7c612873303037cef5ba0329850c35 upstream. This fixes [ 0.000000] i.MX clk 82: register failed with -17 because the name is duplicated. Signed-off-by: Uwe Kleine-König Fixes: 3713e3f5e927 ("clk: imx35: define two clocks for rtc") Acked-by: Shawn Guo Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman commit 650c2b86d42a4dc0e9065f52725891a3c67a58f2 Author: Jan Viktorin Date: Tue May 17 11:22:17 2016 +0200 uio: fix dmem_region_start computation commit 4d31a2588ae37a5d0f61f4d956454e9504846aeb upstream. The variable i contains a total number of resources (including IORESOURCE_IRQ). However, we want the dmem_region_start to point after the last resource of type IORESOURCE_MEM. The original behaviour leads (very likely) to skipping several UIO mapping regions and makes them useless. Fix this by computing dmem_region_start from the uiomem which points to the last used UIO mapping. Fixes: 0a0c3b5a24bd ("Add new uio device for dynamic memory allocation") Signed-off-by: Jan Viktorin Signed-off-by: Greg Kroah-Hartman commit d077eb053d14097ce7c769499d95b2ae1030717d Author: Suzuki K Poulose Date: Thu Aug 25 15:18:54 2016 -0600 coresight: Remove erroneous dma_free_coherent in tmc_probe commit 481e46fe7a88557b66330cbb047b25cc13eff4b9 upstream. commit de5461970b3e9e194 ("coresight: tmc: allocating memory when needed") removed the static allocation of buffer for the trace data in ETR mode in tmc_probe. However it failed to remove the "devm_free_coherent" in tmc_probe when the probe fails due to other reasons. This patch gets rid of the incorrect dma_free_coherent() call. Fixes: commit de5461970b3e9e194 ("coresight: tmc: allocating memory when needed") Cc: Mathieu Poirier Signed-off-by: Suzuki K Poulose Signed-off-by: Mathieu Poirier Signed-off-by: Greg Kroah-Hartman commit a9fb993e3651f8f76d37f9c1d4412a80e8bedf92 Author: Sebastian Frias Date: Mon Aug 1 16:27:38 2016 +0200 genirq/generic_chip: Add irq_unmap callback commit ee26c013cdee0b947e29d6cadfb9ff3341c69ff9 upstream. Without this patch irq_domain_disassociate() cannot properly release the interrupt. In fact, irq_map_generic_chip() checks a bit on 'gc->installed' but said bit is never cleared, only set. Commit 088f40b7b027 ("genirq: Generic chip: Add linear irq domain support") added irq_map_generic_chip() function and also stated "This lacks a removal function for now". This commit provides an implementation of an unmap function that can be called by irq_domain_disassociate(). [ tglx: Made the function static and removed the export as we have neither a prototype nor a modular user. ] Fixes: 088f40b7b027 ("genirq: Generic chip: Add linear irq domain support") Signed-off-by: Sebastian Frias Cc: Marc Zyngier Cc: Mason Cc: Jason Cooper Link: http://lkml.kernel.org/r/579F5C5A.2070507@laposte.net Signed-off-by: Thomas Gleixner Signed-off-by: Greg Kroah-Hartman commit 17fdf0c304fddf0fc4369a54f17f8de148f3688b Author: Uma Krishnan Date: Fri Sep 2 15:39:16 2016 -0500 scsi: cxlflash: Remove the device cleanly in the system shutdown path commit babf985d1e1b0677cb264acd01319d2b9c8f4327 upstream. Commit 704c4b0ddc03 ("cxlflash: Shutdown notify support for CXL Flash cards") was recently introduced to notify the AFU when a system is going down. Due to the position of the cxlflash driver in the device stack, cxlflash devices are _always_ removed during a reboot/shutdown. This can lead to a crash if the cxlflash shutdown hook is invoked _after_ the shutdown hook for the owning virtual PHB. Furthermore, the current implementation of shutdown/remove hooks for cxlflash are not tolerant to being invoked when the device is not enabled. This can also lead to a crash in situations where the remove hook is invoked after the device has been removed via the vPHBs shutdown hook. An example of this scenario would be an EEH reset failure while a reboot/shutdown is in progress. To solve both problems, the shutdown hook for cxlflash is updated to simply remove the device. This path already includes the AFU notification and thus this solution will continue to perform the original intent. At the same time, the remove hook is updated to protect against being called when the device is not enabled. Fixes: 704c4b0ddc03 ("cxlflash: Shutdown notify support for CXL Flash cards") Signed-off-by: Uma Krishnan Acked-by: Matthew R. Ochs Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman commit 5a1bef589179d64202f10a296736a41ca0e98637 Author: Christophe Jaillet Date: Thu Aug 11 16:38:54 2016 +0200 rt2x00usb: Fix error return code commit 410280bac6224e066f4cf0b87db08f0418a135b6 upstream. We know that 'retval = 0' because it has been tested a few lines above. So, if 'devm_kmalloc' fails, 0 will be returned instead of an error code. Return -ENOMEM instead. Fixes: 8b4c0009313f ("rt2x00usb: Use usb anchor to manage URB") Signed-off-by: Christophe JAILLET Acked-by: Stanislaw Gruszka Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman commit ea288a690cc4e53a528ae6a1d37cd6e14320ed27 Author: Jan Kara Date: Mon Sep 19 17:39:09 2016 +0200 posix_acl: Clear SGID bit when setting file permissions commit 073931017b49d9458aa351605b43a7e34598caef upstream. When file permissions are modified via chmod(2) and the user is not in the owning group or capable of CAP_FSETID, the setgid bit is cleared in inode_change_ok(). Setting a POSIX ACL via setxattr(2) sets the file permissions as well as the new ACL, but doesn't clear the setgid bit in a similar way; this allows to bypass the check in chmod(2). Fix that. References: CVE-2016-7097 Reviewed-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Jan Kara Signed-off-by: Andreas Gruenbacher Signed-off-by: Juerg Haefliger Signed-off-by: Greg Kroah-Hartman commit 53114a9ca4a1fab711d58392997200da8a891e8b Author: Chris Wilson Date: Mon Oct 3 13:45:15 2016 +0100 drm/i915: Unalias obj->phys_handle and obj->userptr commit ca5732c53bf66ad755284786897e0dd10330de87 upstream. We use obj->phys_handle to choose the pread/pwrite path, but as obj->phys_handle is a union with obj->userptr, we then mistakenly use the phys_handle path for userptr objects within pread/pwrite. Testcase: igt/gem_userptr_blits/forbidden-operations Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97519 Signed-off-by: Chris Wilson Reviewed-by: Joonas Lahtinen Link: http://patchwork.freedesktop.org/patch/msgid/20161003124516.12388-2-chris@chris-wilson.co.uk (cherry picked from commit 5f12b80a0b42da253691ca03828033014bb786eb) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 53e140b23974aa53e8693ad35af30836a2dc8712 Author: Chris Wilson Date: Mon Oct 3 13:45:14 2016 +0100 drm/i915: Just clear the mmiodebug before a register access commit f856f847b22c52be82f712ea6ada946c6db884d7 upstream. When we enable the per-register access mmiodebug, it is to detect which access is illegal. Reporting on earlier untraced access outside of the mmiodebug does not help debugging (as the suspicion is immediately put upon the current register which is not at fault)! References: https://bugs.freedesktop.org/show_bug.cgi?id=97985 Signed-off-by: Chris Wilson Cc: Mika Kuoppala Reviewed-by: Mika Kuoppala Link: http://patchwork.freedesktop.org/patch/msgid/20161003124516.12388-1-chris@chris-wilson.co.uk (cherry picked from commit dda960335e020835f7f1c12760e7f0b525b451e2) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 44e58783adf5e3a365516ae324e74621751b0626 Author: Ville Syrjälä Date: Mon Oct 3 10:55:16 2016 +0300 drm/i915: Allow DP to work w/o EDID commit 16c83fad79ca912b8b5bbdcb5272794a2be41262 upstream. Allow returning "connected" or "unknown" connector status for DP branch devices that don't have an EDID. Currently we'd claim the thing as "disconnected" if there is no EDID. This stuff used to broken already, I think, but it got more broken by commit f21a21983ef1 ("drm/i915: Splitting intel_dp_detect") Cc: Damien Cassou Cc: freedesktop.org@gp.mailgun.org Cc: Arno Cc: Shubhangi Shrivastava Cc: Sivakumar Thulasimani Cc: Ander Conselvan de Oliveira Tested-by: Arno Fixes: f21a21983ef1 ("drm/i915: Splitting intel_dp_detect") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=83348 Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1475481316-8194-2-git-send-email-ville.syrjala@linux.intel.com Reviewed-by: Ander Conselvan de Oliveira (cherry picked from commit 5cb651a7959310ef4dbb0b93f005b10286789656) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 1d9050ef1806fc01f68a72f85170a64fab932dd0 Author: Ville Syrjälä Date: Mon Oct 3 10:55:15 2016 +0300 drm/i915: Move long hpd handling into the hotplug work commit 1015811609c0328b5ed670d07748591b837e74eb upstream. We can't rely on connector->status in the detect() hook if the long hpd was already handled by the dig_port_work as that won't update connector->status. Thus we have to defer the long hpd handling entirely until the hotplug work runs to avoid the double long hpd handling the "detect_done" flag is trying to prevent. We'll start to depend on connector->status being up to date in a following patch. Cc: Damien Cassou Cc: freedesktop.org@gp.mailgun.org Cc: Arno Cc: Shubhangi Shrivastava Cc: Sivakumar Thulasimani Cc: Ander Conselvan de Oliveira Tested-by: Arno Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=83348 Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1475481316-8194-1-git-send-email-ville.syrjala@linux.intel.com Reviewed-by: Ander Conselvan de Oliveira (cherry picked from commit 27d4efc5591a5853de54713bc717de73c8951e17) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit f81d46c4e159d777e078160f104f217fd249b59b Author: Ville Syrjälä Date: Mon Sep 26 11:30:46 2016 +0300 drm/i915: Allow PCH DPLL sharing regardless of DPLL_SDVO_HIGH_SPEED commit a3fd4c67af3d8a81d241b3d51b3525f36f1d68bb upstream. DPLL_SDVO_HIGH_SPEED must be set for SDVO/HDMI/DP, but nowhere is it forbidden to set it for LVDS/CRT as well. So let's also set it on CRT to make it possible to share the DPLL between HDMI and CRT. What that bit apparently does is enable the x5 clock to the port, which then pumps out the bits on both edges of the clock. The DAC doesn't need that clock since it's not pumping out bits, but I don't think it hurts to have the DPLL output that clock anyway. This is fairly important on IVB since it has only two DPLLs with three pipes. So trying to drive three or more PCH ports with three pipes is only possible when at least one of the DPLLs gets shared between two of the pipes. SNB doesn't really need to do this since it has only two pipes. It could be done to avoid enabling the second DPLL at all in certain cases, but I'm not sure that's such a huge win. So let's not do it for SNB, at least for now. On ILK it never makes sense as the DPLLs can't be shared. v2: Just always enable the high speed clock to keep things simple (Daniel) Beef up the commit message a bit (Daniel) Cc: Nick Yamane Cc: Daniel Vetter Tested-by: Nick Yamane Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97204 Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1474878646-17711-1-git-send-email-ville.syrjala@linux.intel.com Reviewed-by: Ander Conselvan de Oliveira (cherry picked from commit 7d7f8633a82763577727762ff3ac1df3017cb8fe) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 1e599a0d3f71a5e7d821796c269f07e6d022ad5c Author: Lyude Date: Wed Aug 17 15:55:57 2016 -0400 drm/i915/skl: Ensure pipes with changed wms get added to the state commit 05a76d3d6ad1ee9f9814f88949cc9305fc165460 upstream. If we're enabling a pipe, we'll need to modify the watermarks on all active planes. Since those planes won't be added to the state on their own, we need to add them ourselves. Signed-off-by: Lyude Reviewed-by: Matt Roper Cc: Ville Syrjälä Cc: Daniel Vetter Cc: Radhakrishna Sripada Cc: Hans de Goede Signed-off-by: Maarten Lankhorst Link: http://patchwork.freedesktop.org/patch/msgid/1471463761-26796-6-git-send-email-cpaul@redhat.com Signed-off-by: Greg Kroah-Hartman commit 1acb5944cc849f68615e27805c67cf9ea47ab09b Author: Ville Syrjälä Date: Mon Aug 8 13:58:39 2016 +0300 drm/i915: Account for TSEG size when determining 865G stolen base commit d721b02fd00bf133580f431b82ef37f3b746dfb2 upstream. Looks like the TSEG lives just above TOUD, stolen comes after TSEG. The spec seems somewhat self-contradictory in places, in the ESMRAMC register desctription it says: TSEG Size: 10=(TOUD + 512 KB) to TOUD 11 =(TOUD + 1 MB) to TOUD so that agrees with TSEG being at TOUD. But the example given elsehwere in the spec says: TOUD equals 62.5 MB = 03E7FFFFh TSEG selected as 512 KB in size, Graphics local memory selected as 1 MB in size General System RAM available in system = 62.5 MB General system RAM range00000000h to 03E7FFFFh TSEG address range03F80000h to 03FFFFFFh TSEG pre-allocated from03F80000h to 03FFFFFFh Graphics local memory pre-allocated from03E80000h to 03F7FFFFh so here we have TSEG above stolen. Real world evidence agrees with the TOUD->TSEG->stolen order however, so let's fix up the code to account for the TSEG size. Cc: Taketo Kabe Cc: Chris Wilson Cc: Daniel Vetter Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: x86@kernel.org Fixes: 0ad98c74e093 ("drm/i915: Determine the stolen memory base address on gen2") Fixes: a4dff76924fe ("x86/gpu: Add Intel graphics stolen memory quirk for gen2 platforms") Reported-by: Taketo Kabe Tested-by: Taketo Kabe Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=96473 Signed-off-by: Ville Syrjälä Link: http://patchwork.freedesktop.org/patch/msgid/1470653919-27251-1-git-send-email-ville.syrjala@linux.intel.com Link: http://download.intel.com/design/chipsets/datashts/25251405.pdf Reviewed-by: Chris Wilson Signed-off-by: Greg Kroah-Hartman commit d47487d34c0ccca5d48acd9a65c0eefa3c7dd142 Author: David Weinehall Date: Wed Aug 17 15:47:48 2016 +0300 Revert "drm/i915: Check live status before reading edid" commit 23f889bdf6ee5cfff012d8b09f6bec920c691696 upstream. This reverts commit 237ed86c693d8a8e4db476976aeb30df4deac74b. Our current implementation of live status check (repeat 9 times with 10ms delays between each attempt as a workaround for buggy displays) imposes a rather serious penalty, time wise, on intel_hdmi_detect(). Since we we already skip live status checks on platforms before gen 7, and since we seem to have coped quite well before the live status check was introduced for newer platforms too, the previous behaviour is probably preferable, at least unless someone can point to a use-case that the live status check improves (apart from "Bspec says so".) Signed-off-by: David Weinehall Fixes: 237ed86c693d ("drm/i915: Check live status before reading edid") Fixes: f8d03ea0053b ("drm/i915: increase the tries for HDMI hotplug live status checking") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97139 Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94014 Acked-by: Chris Wilson Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/20160817124748.31208-1-david.weinehall@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit d630310aa34e63db04ecbab2dba0511d9016cca7 Author: Paulo Zanoni Date: Thu Sep 22 18:00:29 2016 -0300 drm/i915/kbl: KBL also needs to run the SAGV code commit 17777d61f4a87d7b6d5585e8fdffa83773c594e7 upstream. According to BSpec, it's the "core CPUs" that need the code, which means SKL and KBL, but not BXT. I don't have a KBL to test this patch on it. v2: Only SKL should have I915_SAGV_NOT_CONTROLLED. Reviewed-by: Maarten Lankhorst Signed-off-by: Paulo Zanoni Link: http://patchwork.freedesktop.org/patch/msgid/1474578035-424-4-git-send-email-paulo.r.zanoni@intel.com (cherry picked from commit 6e3100ec21e7c774a0fc01e36a1e0739530c2f71) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit c106eb3e2558712936c10873a32d5d2e63f3dc3d Author: Paulo Zanoni Date: Thu Sep 22 18:00:28 2016 -0300 drm/i915: introduce intel_has_sagv() commit 6e7fdb873d6255ca3c999dd5c6c18962a769ed3e upstream. And use it to move knowledge about the SAGV-supporting platforms from the callers to the SAGV code. We'll add more platforms to intel_has_sagv(), so IMHO it makes more sense to move all this to a single function instead of patching all the callers every time we add SAGV support to a new platform. v2: Move I915_SAGV_NOT_CONTROLLED to the new function (Lyude). Reviewed-by: Maarten Lankhorst Signed-off-by: Paulo Zanoni Link: http://patchwork.freedesktop.org/patch/msgid/1474578035-424-3-git-send-email-paulo.r.zanoni@intel.com (cherry picked from commit 56feca91973459d0b62cbb2610b62d341025ed89) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit dbdcead78603b4eb68d252bb777eabc15a20ae93 Author: Paulo Zanoni Date: Thu Sep 22 18:00:27 2016 -0300 drm/i915: SAGV is not SKL-only, so rename a few things commit 674f823b455cdb94d5773406c1caac170f87e1c4 upstream. The plan is to introduce intel_has_sagv() and then use it to discover which platforms actually support it. I thought about keeping the functions with their current skl names, but found two problems: (i) skl_has_sagv() would become a very confusing name, and (ii) intel_atomic_commit_tail() doesn't seem to be calling any functions whose name start with a platform name, so the "intel_" naming scheme seems make more sense than the "firstplatorm_" naming scheme here. Reviewed-by: Lyude Reviewed-by: Maarten Lankhorst Signed-off-by: Paulo Zanoni Link: http://patchwork.freedesktop.org/patch/msgid/1474578035-424-2-git-send-email-paulo.r.zanoni@intel.com (cherry picked from commit 16dcdc4edbcf5cb130004737f2548401776170f1) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit b84d697f916c65d41476e75b25dbd372e5f80fb4 Author: Paulo Zanoni Date: Thu Sep 22 18:00:33 2016 -0300 drm/i915/gen9: fix the watermark res_blocks value commit 73fed0ef8567f1e1cba079994353e60208ded964 upstream. We forgot the "res_blocks += y_tile_minimum" that's described on step V of our documentation. Again, this should only affect the Y tiling cases. It looks like the relevant code was introduced in 0fda65680e92, but there's always the possibility that it matched our specification when it was introduced, and then the specification changed while the code stayed the same. So we can't really say this was a regression, but let's try to add a "Fixes" tag anyway to help backporting. v2: Try to add a "Fixes" tag (Maarten). Fixes: 0fda65680e92 ("drm/i915/skl: Update watermarks for Y tiling") Cc: Tvrtko Ursulin Reviewed-by: Lyude Reviewed-by: Maarten Lankhorst Signed-off-by: Paulo Zanoni Link: http://patchwork.freedesktop.org/patch/msgid/1474578035-424-8-git-send-email-paulo.r.zanoni@intel.com (cherry picked from commit 75676ed423a6acf9e2b1df52fbc036a51e11fb7a) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 8b38f7a08cdd573a2afad967bab032f819a7bb68 Author: Paulo Zanoni Date: Thu Sep 22 18:00:32 2016 -0300 drm/i915/gen9: fix plane_blocks_per_line on watermarks calculations commit cf6c525a31fac11b0775b8c06c00a508c6356d9b upstream. The confusing thing is that plane_blocks_per_line is listed as part of the method 2 calculation but is also used for other things. We calculated it in two different places and different ways: one inside skl_wm_method2() and the other inside skl_compute_plane_wm(). The skl_wm_method2() implementation is the one that matches the specification. With this patch we fix the skl_compute_plane_wm() calculation and just pass it as a parameter to skl_wm_method2(). We also take care to not modify the value of plane_bytes_per_line since we're going to rely on it having a correct value in later patches. This should affect the watermarks for Linear and Y-tiled. From my analysis, it looks like the two plane_blocks_per_line variables got out of sync on 0fda65680e92, but we can't really say that commit was a regression, it looks like just an incomplete fix. There's always the possibility that 0fda65680e92 matched our specification at that time, and then later the specification changed. v2: Try to add a "Fixes" tag (Maarten). Fixes: 0fda65680e92 ("drm/i915/skl: Update watermarks for Y tiling") Cc: Tvrtko Ursulin Reviewed-by: Lyude Reviewed-by: Maarten Lankhorst Signed-off-by: Paulo Zanoni Link: http://patchwork.freedesktop.org/patch/msgid/1474578035-424-7-git-send-email-paulo.r.zanoni@intel.com (cherry picked from commit 7a1a8aed67e0a60772defe3f6499eb340da48634) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit bca8acf64a6a55bb4034fac084adc53182281096 Author: Paulo Zanoni Date: Thu Sep 22 18:00:31 2016 -0300 drm/i915/gen9: minimum scanlines for Y tile is not always 4 commit ccc1057477bc99678896b51adce6b6ee4019dc37 upstream. During watermarks calculations, this value is used in 3 different places. Only one of them was not using a hardcoded 4. Move the code up so everybody can benefit from the actual value. This should only help on situations with Y tiling + 90/270 rotation + 1 or 2 bpp or NV12. Reviewed-by: Maarten Lankhorst Signed-off-by: Paulo Zanoni Link: http://patchwork.freedesktop.org/patch/msgid/1474578035-424-6-git-send-email-paulo.r.zanoni@intel.com (cherry picked from commit 1186fa85eb9b3cc0589990fbc39617e50e38759a) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit f74467fb3df1b77b6787287bbcf2a7c0f7000bac Author: Paulo Zanoni Date: Thu Sep 22 18:00:30 2016 -0300 drm/i915/gen9: fix the WaWmMemoryReadLatency implementation commit 4e4d3814a9bb4d71cd3ff0701d8d7041edefd8f0 upstream. Bspec says: "The mailbox response data may not account for memory read latency. If the mailbox response data for level 0 is 0us, add 2 microseconds to the result for each valid level." This means we should only do the +2 in case wm[0] == 0, not always. So split the sanitizing implementation from the WA implementation and fix the WA implementation. v2: Add Fixes tag (Maarten). Fixes: 367294be7c25 ("drm/i915/gen9: Add 2us read latency to WM level") Cc: Vandana Kannan Reviewed-by: Maarten Lankhorst Signed-off-by: Paulo Zanoni Link: http://patchwork.freedesktop.org/patch/msgid/1474578035-424-5-git-send-email-paulo.r.zanoni@intel.com (cherry picked from commit 0727e40a48a1d08cf54ce2c01e120864b92e59bf) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 3dd241580298a56fcba209fdc9b677bae31bcdee Author: Paulo Zanoni Date: Thu Sep 29 16:36:48 2016 -0300 drm/i915/gen9: only add the planes actually affected by ddb changes commit be5c571b2ff3a164d2e14ccc100cb5b2b3d3fb7c upstream. We were previously adding all the planes owned by the CRTC even when the ddb partitioning didn't change for them. As a consequence, a lot of functions were being called when we were just moving the cursor around the screen, such as skylake_update_primary_plane(). This was causing flickering on the primary plane when moving the cursor. I'm not 100% sure which operation caused the flickering, but we were writing to a lot of registers, so it could be any of these writes. With this patch, just moving the mouse won't add the primary plane to the commit since it won't trigger a change in DDB partitioning. v2: Use skl_ddb_entry_equal() (Lyude). v3: Change Reported-and-bisected-by: to Reported-by: for checkpatch Fixes: 05a76d3d6ad1 ("drm/i915/skl: Ensure pipes with changed wms get added to the state") Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97888 Cc: Mike Lothian Reported-by: Mike Lothian Signed-off-by: Paulo Zanoni Signed-off-by: Lyude Link: http://patchwork.freedesktop.org/patch/msgid/1475177808-29955-1-git-send-email-paulo.r.zanoni@intel.com (cherry picked from commit 7f60e200e254cd53ad1bd74a56bdd23e813ac4b7) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 44e97ca6fb778ba7586cd5ad34afa0f789f88e17 Author: Lyude Date: Mon Aug 29 12:31:27 2016 -0400 drm/i915/skl: Don't try to update plane watermarks if they haven't changed commit ccebc23b57c313229526dc76383ce82f5e0b9001 upstream. i915 sometimes needs to disable planes in the middle of an atomic commit, and then reenable them later in the same commit. Because of this, we can't make the assumption that the state of the plane actually changed. Since the state of the plane hasn't actually changed, neither have it's watermarks. And if the watermarks hasn't changed then we haven't populated skl_results with anything, which means we'll end up zeroing out a plane's watermarks in the middle of the atomic commit without restoring them later. Simple reproduction recipe: - Get a SKL laptop, launch any kind of X session - Get two extra monitors - Keep hotplugging both displays (so that the display configuration jumps from 1 active pipe to 3 active pipes and back) - Eventually underrun Changes since v1: - Fix incorrect use of "it's" Changes since v2: - Add reproduction recipe Signed-off-by: Lyude Cc: Maarten Lankhorst Fixes: 62e0fb880123 ("drm/i915/skl: Update plane watermarks atomically during plane updates") Signed-off-by: Lyude Testcase: kms_plane Signed-off-by: Maarten Lankhorst Link: http://patchwork.freedesktop.org/patch/msgid/1472488288-27280-1-git-send-email-cpaul@redhat.com Cc: drm-intel-fixes@lists.freedesktop.org Signed-off-by: Greg Kroah-Hartman commit d64cdbd9291fbc569ba6a5ccef1dd697a10f8d20 Author: Lyude Date: Wed Aug 24 07:48:10 2016 +0200 drm/i915/skl: Update DDB values atomically with wms/plane attrs commit 27082493e9c6371b05370a619ab9d2877c5f4726 upstream. Now that we can hook into update_crtcs and control the order in which we update CRTCs at each modeset, we can finish the final step of fixing Skylake's watermark handling by performing DDB updates at the same time as plane updates and watermark updates. The first major change in this patch is skl_update_crtcs(), which handles ensuring that we order each CRTC update in our atomic commits properly so that they honor the DDB flush order. The second major change in this patch is the order in which we flush the pipes. While the previous order may have worked, it can't be used in this approach since it no longer will do the right thing. For example, using the old ddb flush order: We have pipes A, B, and C enabled, and we're disabling C. Initial ddb allocation looks like this: | A | B |xxxxxxx| Since we're performing the ddb updates after performing any CRTC disablements in intel_atomic_commit_tail(), the space to the right of pipe B is unallocated. 1. Flush pipes with new allocation contained into old space. None apply, so we skip this 2. Flush pipes having their allocation reduced, but overlapping with a previous allocation. None apply, so we also skip this 3. Flush pipes that got more space allocated. This applies to A and B, giving us the following update order: A, B This is wrong, since updating pipe A first will cause it to overlap with B and potentially burst into flames. Our new order (see the code comments for details) would update the pipes in the proper order: B, A. As well, we calculate the order for each DDB update during the check phase, and reference it later in the commit phase when we hit skl_update_crtcs(). This long overdue patch fixes the rest of the underruns on Skylake. Changes since v1: - Add skl_ddb_entry_write() for cursor into skl_write_cursor_wm() Changes since v2: - Use the method for updating CRTCs that Ville suggested - In skl_update_wm(), only copy the watermarks for the crtc that was passed to us Changes since v3: - Small comment fix in skl_ddb_allocation_overlaps() Changes since v4: - Remove the second loop in intel_update_crtcs() and use Ville's suggestion for updating the ddb allocations in the right order - Get rid of the second loop and just use the ddb state as it updates to determine what order to update everything in (thanks for the suggestion Ville) - Simplify skl_ddb_allocation_overlaps() - Split actual overlap checking into it's own helper Fixes: 0e8fb7ba7ca5 ("drm/i915/skl: Flush the WM configuration") Fixes: 8211bd5bdf5e ("drm/i915/skl: Program the DDB allocation") [omitting CC for stable, since this patch will need to be changed for such backports first] Testcase: kms_cursor_legacy Testcase: plane-all-modeset-transition Signed-off-by: Lyude Cc: Ville Syrjälä Cc: Daniel Vetter Cc: Radhakrishna Sripada Cc: Hans de Goede Cc: Matt Roper Signed-off-by: Maarten Lankhorst Link: http://patchwork.freedesktop.org/patch/msgid/1471961565-28540-2-git-send-email-cpaul@redhat.com Signed-off-by: Greg Kroah-Hartman commit be072a562b78aa3219c03a2aecadd99905fd4aa4 Author: Lyude Date: Wed Aug 24 07:48:09 2016 +0200 drm/i915: Move CRTC updating in atomic_commit into it's own hook commit 896e5bb022bce64e29ce2e1b2fc2a7476d311a15 upstream. Since we have to write ddb allocations at the same time as we do other plane updates, we're going to need to be able to control the order in which we execute modesets on each pipe. The easiest way to do this is to just factor this section of intel_atomic_commit_tail() (intel_atomic_commit() for stable branches) into it's own function, and add an appropriate display function hook for it. Based off of Matt Rope's suggestions Changes since v1: - Drop pipe_config->base.active check in intel_update_crtcs() since we check that before calling the function Signed-off-by: Lyude Reviewed-by: Matt Roper [omitting CC for stable, since this patch will need to be changed for such backports first] Cc: Ville Syrjälä Cc: Daniel Vetter Cc: Radhakrishna Sripada Cc: Hans de Goede Signed-off-by: Lyude Signed-off-by: Maarten Lankhorst Link: http://patchwork.freedesktop.org/patch/msgid/1471961565-28540-1-git-send-email-cpaul@redhat.com Signed-off-by: Greg Kroah-Hartman commit 00dcbda55115994c1feb6bbfe2c4ef21de7c59fb Author: Lyude Date: Mon Aug 22 12:50:08 2016 -0400 drm/i915/skl: Update plane watermarks atomically during plane updates commit 62e0fb880123c98793e5c3ba8355501b0305e92e upstream. Thanks to Ville for suggesting this as a potential solution to pipe underruns on Skylake. On Skylake all of the registers for configuring planes, including the registers for configuring their watermarks, are double buffered. New values written to them won't take effect until said registers are "armed", which is done by writing to the PLANE_SURF (or in the case of cursor planes, the CURBASE register) register. With this in mind, up until now we've been updating watermarks on skl like this: non-modeset { - calculate (during atomic check phase) - finish_atomic_commit: - intel_pre_plane_update: - intel_update_watermarks() - {vblank happens; new watermarks + old plane values => underrun } - drm_atomic_helper_commit_planes_on_crtc: - start vblank evasion - write new plane registers - end vblank evasion } or modeset { - calculate (during atomic check phase) - finish_atomic_commit: - crtc_enable: - intel_update_watermarks() - {vblank happens; new watermarks + old plane values => underrun } - drm_atomic_helper_commit_planes_on_crtc: - start vblank evasion - write new plane registers - end vblank evasion } Now we update watermarks atomically like this: non-modeset { - calculate (during atomic check phase) - finish_atomic_commit: - intel_pre_plane_update: - intel_update_watermarks() (wm values aren't written yet) - drm_atomic_helper_commit_planes_on_crtc: - start vblank evasion - write new plane registers - write new wm values - end vblank evasion } modeset { - calculate (during atomic check phase) - finish_atomic_commit: - crtc_enable: - intel_update_watermarks() (actual wm values aren't written yet) - drm_atomic_helper_commit_planes_on_crtc: - start vblank evasion - write new plane registers - write new wm values - end vblank evasion } So this patch moves all of the watermark writes into the right place; inside of the vblank evasion where we update all of the registers for each plane. While this patch doesn't fix everything, it does allow us to update the watermark values in the way the hardware expects us to. Changes since original patch series: - Remove mutex_lock/mutex_unlock since they don't do anything and we're not touching global state - Move skl_write_cursor_wm/skl_write_plane_wm functions into intel_pm.c, make externally visible - Add skl_write_plane_wm calls to skl_update_plane - Fix conditional for for loop in skl_write_plane_wm (level < max_level should be level <= max_level) - Make diagram in commit more accurate to what's actually happening - Add Fixes: Changes since v1: - Use IS_GEN9() instead of IS_SKYLAKE() since these fixes apply to more then just Skylake - Update description to make it clear this patch doesn't fix everything - Check if pipes were actually changed before writing watermarks Changes since v2: - Write PIPE_WM_LINETIME during vblank evasion Changes since v3: - Rebase against new SAGV patch changes Changes since v4: - Add a parameter to choose what skl_wm_values struct to use when writing new plane watermarks Changes since v5: - Remove cursor ddb entry write in skl_write_cursor_wm(), defer until patch 6 - Write WM_LINETIME in intel_begin_crtc_commit() Changes since v6: - Remove redundant dirty_pipes check in skl_write_plane_wm (we check this in all places where we call this function, and it was supposed to have been removed earlier anyway) - In i9xx_update_cursor(), use dev_priv->info.gen >= 9 instead of IS_GEN9(dev_priv). We do this everywhere else and I'd imagine this needs to be done for gen10 as well Changes since v7: - Fix rebase fail (unused variable obj) - Make struct skl_wm_values *wm const - Fix indenting - Use INTEL_GEN() instead of dev_priv->info.gen Changes since v8: - Don't forget calls to skl_write_plane_wm() when disabling planes - Use INTEL_GEN(), not INTEL_INFO()->gen in intel_begin_crtc_commit() Fixes: 2d41c0b59afc ("drm/i915/skl: SKL Watermark Computation") Signed-off-by: Lyude Reviewed-by: Matt Roper Cc: stable@vger.kernel.org Cc: Ville Syrjälä Cc: Daniel Vetter Cc: Radhakrishna Sripada Cc: Hans de Goede Signed-off-by: Maarten Lankhorst Link: http://patchwork.freedesktop.org/patch/msgid/1471884608-10671-1-git-send-email-cpaul@redhat.com Link: http://patchwork.freedesktop.org/patch/msgid/1471884608-10671-1-git-send-email-cpaul@redhat.com Signed-off-by: Greg Kroah-Hartman commit ef723aa5a85149f3471cc1bf78b95b1cf46b712e Author: Steinar H. Gunderson Date: Sun Oct 9 14:21:50 2016 +0200 HID: add quirk for Akai MIDImix. commit 4973ca9a01e2354b159acedec1b9b8eb8de02ab7 upstream. The Akai MIDImix (09e8:0031) is a MIDI fader controller that speaks regular MIDI and works well with Linux. However, initialization gets delayed due to reports timeout: [3643645.631124] hid-generic 0003:09E8:0031.0020: timeout initializing reports [3643645.632416] hid-generic 0003:09E8:0031.0020: hiddev0: USB HID v1.11 Device [AKAI MIDI Mix] on usb-0000:00:14.0-2/input0 Adding "usbhid.quirks=0x09e8:0x0031:0x20000000" on the kernel command line makes the issues go away. Signed-off-by: Steinar H. Gunderson Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman commit 4b5518b8033ac6ac690edb03970da7d413adeb9c Author: Rex Zhu Date: Wed Sep 14 13:20:34 2016 +0800 drm/amd/powerplay: fix mclk not switching back after multi-head was disabled commit 9716ebc38dfabe6c8e5e3c809e9f3c61dd3740f9 upstream. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit d4e00e3800559f9aad56e958dd611c39f98bfb2c Author: Stefan Agner Date: Fri Sep 2 11:23:37 2016 -0700 drm/fsl-dcu: fix endian issue when using clk_register_divider commit 6cc4758ae91c0582f07e3c94c7de1ad0975feff5 upstream. Since using clk_register_divider to setup the pixel clock, regmap is no longer used. Regmap did take care of DCU using different endianness. Check endianness using the device-tree property "big-endian" to determine the location of DIV_RATIO. Fixes: 2d701449bce1 ("drm/fsl-dcu: use common clock framework for pixel clock divider") Reported-by: Meng Yi Signed-off-by: Stefan Agner Tested-by: Meng Yi Signed-off-by: Greg Kroah-Hartman commit 4bef3516f50df6efd3bc9ae370b6107341241b1b Author: Thomas Hellstrom Date: Mon Oct 10 10:51:24 2016 -0700 drm/vmwgfx: Limit the user-space command buffer size commit 51ab70bed997f64f091a639dbe22b629725a7faf upstream. With older hardware versions, the user could specify arbitrarily large command buffer sizes, causing a vmalloc / vmap space exhaustion. Signed-off-by: Thomas Hellstrom Reviewed-by: Brian Paul Reviewed-by: Sinclair Yeh Signed-off-by: Sinclair Yeh Signed-off-by: Greg Kroah-Hartman commit 73e35e4200ea96b1876aafb44734bced88c335a4 Author: Alex Deucher Date: Wed Oct 12 15:28:55 2016 -0400 drm/radeon: change vblank_time's calculation method to reduce computational error. commit 02cfb5fccb0f9f968f0e208d89d9769aa16267bc upstream. Ported from Rex's amdgpu change. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 4fb5e84d4e886946d6d20c91da1f6cdacd0611a4 Author: Alex Deucher Date: Tue Sep 27 14:51:53 2016 -0400 drm/radeon/si/dpm: fix phase shedding setup commit 427920292b00474d978d632bc03a8e4e50029af3 upstream. Used the wrong index to setup the phase shedding mask. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 3c80c24034e893c2c68c6c1d55be04ac22803f13 Author: Alex Deucher Date: Mon Sep 19 12:35:22 2016 -0400 drm/radeon: narrow asic_init for virtualization commit 884031f0aacf57dad1575f96714efc80de9b19cc upstream. Only needed on CIK+ due to the way pci reset is handled by the GPU. Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit e14979782b2a196eaf0084d473a1d3e0e81a29a0 Author: Rex Zhu Date: Mon Oct 10 15:57:21 2016 +0800 drm/amdgpu: change vblank_time's calculation method to reduce computational error. commit dc8184aa8621ee8048652496884d9f40d4bb407f upstream. Signed-off-by: Rex Zhu Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 3feb1c778723ca8f19e69fc64e2d662f6ff8c617 Author: Nicolai Hähnle Date: Tue Oct 4 09:43:30 2016 +0200 drm/amdgpu: initialize the context reset_counter in amdgpu_ctx_init commit ce199ad690bd0a6ac6bf9e4df2c87b59d76f84da upstream. Ensure that we really only report a GPU reset if one has happened since the creation of the context. Signed-off-by: Nicolai Hähnle Reviewed-by: Christian König Signed-off-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit bc7a69bcb0d71183fbff25d5edc3b3054d28a502 Author: Grazvydas Ignotas Date: Mon Oct 3 00:06:45 2016 +0300 drm/amdgpu/dce11: add missing drm_mode_config_cleanup call commit 140c94da3c3338c0ff4cc127cf9bec87905ca83c upstream. All other amdgpu/dce_v* files have this call, it's only mysteriously missing from dce_v11_0.c since the file was added and causes leaks. Fixes: aaa36a976bbb ("drm/amdgpu: Add initial VI support") Signed-off-by: Grazvydas Ignotas Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit b672f5f327b6f5fd24fde0508b0a2865ce337e25 Author: Alex Deucher Date: Wed Sep 28 12:43:33 2016 -0400 drm/amdgpu/dce11: disable hpd on local panels commit 3a9d993ee9809c217f4322623a9b78c8d17fdd1f upstream. Otherwise we can get a hotplug interrupt storm when we turn the panel off if hpd interrupts were enabled by the bios. bug: https://bugs.freedesktop.org/show_bug.cgi?id=97471 Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit b5ef9ceac598722888fbfcc5785c622df1138863 Author: Alex Deucher Date: Wed Sep 28 12:44:20 2016 -0400 drm/amdgpu/dce8: disable hpd on local panels commit 324082586cc5918e3230f0b2f326656c653201eb upstream. Otherwise we can get a hotplug interrupt storm when we turn the panel off if hpd interrupts were enabled by the bios. bug: https://bugs.freedesktop.org/show_bug.cgi?id=97471 Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit a7692cb26ac22889d5daa606f218782a30c401cb Author: Alex Deucher Date: Wed Sep 28 12:41:50 2016 -0400 drm/amdgpu/dce10: disable hpd on local panels commit e96ec90f496603c48e0945f8bdeb4cdf3088cbba upstream. Otherwise we can get a hotplug interrupt storm when we turn the panel off if hpd interrupts were enabled by the bios. bug: https://bugs.freedesktop.org/show_bug.cgi?id=97471 Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit ce1c353198b277fcbd8201d48d5ec4fab5734ffe Author: Alex Deucher Date: Mon Aug 22 16:31:36 2016 -0400 drm/amdgpu: fix IB alignment for UVD commit c4795ca642b8bd76b5b6ffba41ba909543273d43 upstream. According to the hw team, it should be 16, not 8. Cc: Peter Fang Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 0a103329d3987d530c8deb6fd8cd33f229157bb7 Author: Shawn Lee Date: Mon Sep 19 13:35:26 2016 +0300 drm/i915/backlight: setup backlight pwm alternate increment on backlight enable commit 915b417946030e1f365c63728875cffd8db8e880 upstream. Backlight enable is supposed to do a full setup of the backlight. We were missing the PWM alternate increment bit in the south chicken registers on lpt+ pch. This potentially caused a PWM frequency change when the chicken register value was lost e.g. on suspend. v2 by Jani, rebase on the patch caching alt increment Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=97486 References: https://bugs.freedesktop.org/show_bug.cgi?id=67454 Cc: Cooper Chiou Cc: Wei Shun Chen Cc: Gary C Wang Reviewed-by: Ville Syrjälä Signed-off-by: Shawn Lee Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/8265f5935bd31c039ddfc82819d26c2ca1ae9cba.1474281249.git.jani.nikula@intel.com (cherry picked from commit e29aff05f239f8dd24e9ee7816fd96726e20105a) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 6dd6e852295860071d57991fc15df28d3227150e Author: Jani Nikula Date: Mon Sep 19 13:35:25 2016 +0300 drm/i915/backlight: setup and cache pwm alternate increment value commit 16e1203db8ab740c912ea62761fdf27d7811b886 upstream. This will also be needed later on when setting up the alternate increment in backlight enable. Cc: Shawn Lee Reviewed-by: Ville Syrjälä Signed-off-by: Jani Nikula Link: http://patchwork.freedesktop.org/patch/msgid/9984b20bc59aee90b83caf59ce91f3fb122c9627.1474281249.git.jani.nikula@intel.com (cherry picked from commit 32b421e79e6b546da1d469f1229403ac9142d695) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit b09e49284c7aed77965430dff098703aaaf04573 Author: Chris Wilson Date: Wed Oct 5 13:21:43 2016 +0100 drm/prime: Pass the right module owner through to dma_buf_export() commit 56a76c0123d6cb034975901c80fce2627338ef9e upstream. dma_buf_export() adds a reference to the owning module to the dmabuf (to prevent the driver from being unloaded whilst a third party still refers to the dmabuf). However, drm_gem_prime_export() was passing its own THIS_MODULE (i.e. drm.ko) rather than the driver. Extract the right owner from the device->fops instead. v2: Use C99 initializers to zero out unset elements of dma_buf_export_info v3: Extract the right module from dev->fops. Testcase: igt/vgem_basic/unload Reported-by: Petri Latvala Signed-off-by: Chris Wilson Cc: Petri Latvala Cc: Christian König Tested-by: Petri Latvala Reviewed-by: Petri Latvala Reviewed-by: Christian König Signed-off-by: Daniel Vetter Link: http://patchwork.freedesktop.org/patch/msgid/20161005122145.1507-1-chris@chris-wilson.co.uk Signed-off-by: Greg Kroah-Hartman commit 17ec8f95eddc1d0ba2560ed25256e6ca417638c2 Author: Eric Anholt Date: Tue Sep 27 09:03:13 2016 -0700 drm/vc4: Fix races when the CS reads from render targets. commit 7edabee06a5622190d59689a64f5e17d1c343cc3 upstream. With the introduction of bin/render pipelining, the previous job may not be completed when we start binning the next one. If the previous job wrote our VBO, IB, or CS textures, then the binning stage might get stale or uninitialized results. Fixes the major rendering failure in glmark2 -b terrain. Signed-off-by: Eric Anholt Fixes: ca26d28bbaa3 ("drm/vc4: improve throughput by pipelining binning and rendering jobs") Signed-off-by: Greg Kroah-Hartman