Merge remote-tracking branch 'origin/master'kernel-4.9.0-0.rc3.git2.1.vanilla.knurd.1.fc26kernel-4.9.0-0.rc3.git2.1.vanilla.knurd.1.fc25kernel-4.9.0-0.rc3.git2.1.vanilla.knurd.1.fc24kernel-4.9.0-0.rc3.git2.1.vanilla.knurd.1.fc23

7 files changed, 257 insertions, 108 deletions

diff --git a/ARM-OMAP4-Fix-crashes.patch b/ARM-OMAP4-Fix-crashes.patch
new file mode 100644
index 000000000..5a4a257e1
--- /dev/null
+++ b/ARM-OMAP4-Fix-crashes.patch
@@ -0,0 +1,46 @@
+From patchwork Wed Oct 26 15:17:01 2016
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [3/5] ARM: OMAP4+: Fix bad fallthrough for cpuidle
+From: Tony Lindgren <tony@atomide.com>
+X-Patchwork-Id: 9397501
+Message-Id: <20161026151703.24730-4-tony@atomide.com>
+To: linux-omap@vger.kernel.org
+Cc: Nishanth Menon <nm@ti.com>, Dmitry Lifshitz <lifshitz@compulab.co.il>,
+ Dave Gerlach <d-gerlach@ti.com>,
+ Enric Balletbo Serra <eballetbo@gmail.com>, 
+ "Dr . H . Nikolaus Schaller" <hns@goldelico.com>,
+ Pau Pajuel <ppajuel@gmail.com>, Grazvydas Ignotas <notasas@gmail.com>,
+ Benoit Cousson <bcousson@baylibre.com>,
+ Santosh Shilimkar <ssantosh@kernel.org>,
+ Javier Martinez Canillas <javier@dowhile0.org>,
+ Robert Nelson <robertcnelson@gmail.com>,
+ Marek Belisko <marek@goldelico.com>, linux-arm-kernel@lists.infradead.org
+Date: Wed, 26 Oct 2016 08:17:01 -0700
+
+We don't want to fall through to a bunch of errors for retention
+if PM_OMAP4_CPU_OSWR_DISABLE is not configured for a SoC.
+
+Fixes: 6099dd37c669 ("ARM: OMAP5 / DRA7: Enable CPU RET on suspend")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+---
+ arch/arm/mach-omap2/omap-mpuss-lowpower.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
+--- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
++++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
+@@ -244,10 +244,9 @@ int omap4_enter_lowpower(unsigned int cpu, unsigned int power_state)
+ 		save_state = 1;
+ 		break;
+ 	case PWRDM_POWER_RET:
+-		if (IS_PM44XX_ERRATUM(PM_OMAP4_CPU_OSWR_DISABLE)) {
++		if (IS_PM44XX_ERRATUM(PM_OMAP4_CPU_OSWR_DISABLE))
+ 			save_state = 0;
+-			break;
+-		}
++		break;
+ 	default:
+ 		/*
+ 		 * CPUx CSWR is invalid hardware state. Also CPUx OSWR
diff --git a/arm-revert-mmc-omap_hsmmc-Use-dma_request_chan-for-reque.patch b/arm-revert-mmc-omap_hsmmc-Use-dma_request_chan-for-reque.patch
new file mode 100644
index 000000000..b55dec0cb
--- /dev/null
+++ b/arm-revert-mmc-omap_hsmmc-Use-dma_request_chan-for-reque.patch
@@ -0,0 +1,100 @@
+From bb3e08008c0e48fd4f51a0f0957eecae61a24d69 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Tue, 1 Nov 2016 09:35:30 +0000
+Subject: [PATCH] Revert "mmc: omap_hsmmc: Use dma_request_chan() for
+ requesting DMA channel"
+
+This reverts commit 81eef6ca92014845d40e3f1310e42b7010303acc.
+---
+ drivers/mmc/host/omap_hsmmc.c | 50 ++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 40 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 24ebc9a..3563321 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -32,6 +32,7 @@
+ #include <linux/of_irq.h>
+ #include <linux/of_gpio.h>
+ #include <linux/of_device.h>
++#include <linux/omap-dmaengine.h>
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/core.h>
+ #include <linux/mmc/mmc.h>
+@@ -1992,6 +1993,8 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 	struct resource *res;
+ 	int ret, irq;
+ 	const struct of_device_id *match;
++	dma_cap_mask_t mask;
++	unsigned tx_req, rx_req;
+ 	const struct omap_mmc_of_data *data;
+ 	void __iomem *base;
+ 
+@@ -2121,17 +2124,44 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
+ 
+ 	omap_hsmmc_conf_bus_power(host);
+ 
+-	host->rx_chan = dma_request_chan(&pdev->dev, "rx");
+-	if (IS_ERR(host->rx_chan)) {
+-		dev_err(mmc_dev(host->mmc), "RX DMA channel request failed\n");
+-		ret = PTR_ERR(host->rx_chan);
++	if (!pdev->dev.of_node) {
++		res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "tx");
++		if (!res) {
++			dev_err(mmc_dev(host->mmc), "cannot get DMA TX channel\n");
++			ret = -ENXIO;
++			goto err_irq;
++		}
++		tx_req = res->start;
++
++		res = platform_get_resource_byname(pdev, IORESOURCE_DMA, "rx");
++		if (!res) {
++			dev_err(mmc_dev(host->mmc), "cannot get DMA RX channel\n");
++			ret = -ENXIO;
++			goto err_irq;
++		}
++		rx_req = res->start;
++	}
++
++	dma_cap_zero(mask);
++	dma_cap_set(DMA_SLAVE, mask);
++
++	host->rx_chan =
++		dma_request_slave_channel_compat(mask, omap_dma_filter_fn,
++						 &rx_req, &pdev->dev, "rx");
++
++	if (!host->rx_chan) {
++		dev_err(mmc_dev(host->mmc), "unable to obtain RX DMA engine channel\n");
++		ret = -ENXIO;
+ 		goto err_irq;
+ 	}
+ 
+-	host->tx_chan = dma_request_chan(&pdev->dev, "tx");
+-	if (IS_ERR(host->tx_chan)) {
+-		dev_err(mmc_dev(host->mmc), "TX DMA channel request failed\n");
+-		ret = PTR_ERR(host->tx_chan);
++	host->tx_chan =
++		dma_request_slave_channel_compat(mask, omap_dma_filter_fn,
++						 &tx_req, &pdev->dev, "tx");
++
++	if (!host->tx_chan) {
++		dev_err(mmc_dev(host->mmc), "unable to obtain TX DMA engine channel\n");
++		ret = -ENXIO;
+ 		goto err_irq;
+ 	}
+ 
+@@ -2189,9 +2219,9 @@ err_slot_name:
+ 	mmc_remove_host(mmc);
+ err_irq:
+ 	device_init_wakeup(&pdev->dev, false);
+-	if (!IS_ERR_OR_NULL(host->tx_chan))
++	if (host->tx_chan)
+ 		dma_release_channel(host->tx_chan);
+-	if (!IS_ERR_OR_NULL(host->rx_chan))
++	if (host->rx_chan)
+ 		dma_release_channel(host->rx_chan);
+ 	pm_runtime_dont_use_autosuspend(host->dev);
+ 	pm_runtime_put_sync(host->dev);
+-- 
+2.9.3
+
diff --git a/arm64-mm-Fix-memmap-to-be-initialized-for-the-entire-section.patch b/arm64-mm-Fix-memmap-to-be-initialized-for-the-entire-section.patch
new file mode 100644
index 000000000..eaf809d53
--- /dev/null
+++ b/arm64-mm-Fix-memmap-to-be-initialized-for-the-entire-section.patch
@@ -0,0 +1,93 @@
+From patchwork Thu Oct  6 09:52:07 2016
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: arm64: mm: Fix memmap to be initialized for the entire section
+From: Robert Richter <rrichter@cavium.com>
+X-Patchwork-Id: 9364537
+Message-Id: <1475747527-32387-1-git-send-email-rrichter@cavium.com>
+To: Catalin Marinas <catalin.marinas@arm.com>, Will Deacon
+ <will.deacon@arm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>, linux-efi@vger.kernel.org,
+ David Daney <david.daney@cavium.com>,
+ Ard Biesheuvel <ard.biesheuvel@linaro.org>,
+ linux-kernel@vger.kernel.org, Robert Richter <rrichter@cavium.com>,
+ Hanjun Guo <hanjun.guo@linaro.org>, linux-arm-kernel@lists.infradead.org
+Date: Thu, 6 Oct 2016 11:52:07 +0200
+
+There is a memory setup problem on ThunderX systems with certain
+memory configurations. The symptom is
+
+ kernel BUG at mm/page_alloc.c:1848!
+
+This happens for some configs with 64k page size enabled. The bug
+triggers for page zones with some pages in the zone not assigned to
+this particular zone. In my case some pages that are marked as nomap
+were not reassigned to the new zone of node 1, so those are still
+assigned to node 0.
+
+The reason for the mis-configuration is a change in pfn_valid() which
+reports pages marked nomap as invalid:
+
+ 68709f45385a arm64: only consider memblocks with NOMAP cleared for linear mapping
+
+This causes pages marked as nomap being no long reassigned to the new
+zone in memmap_init_zone() by calling __init_single_pfn().
+
+Fixing this by restoring the old behavior of pfn_valid() to use
+memblock_is_memory(). Also changing users of pfn_valid() in arm64 code
+to use memblock_is_map_memory() where necessary. This only affects
+code in ioremap.c. The code in mmu.c still can use the new version of
+pfn_valid().
+
+Should be marked stable v4.5..
+
+Signed-off-by: Robert Richter <rrichter@cavium.com>
+---
+ arch/arm64/mm/init.c    | 2 +-
+ arch/arm64/mm/ioremap.c | 5 +++--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
+index bbb7ee76e319..25b8659c2a9f 100644
+--- a/arch/arm64/mm/init.c
++++ b/arch/arm64/mm/init.c
+@@ -147,7 +147,7 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max)
+ #ifdef CONFIG_HAVE_ARCH_PFN_VALID
+ int pfn_valid(unsigned long pfn)
+ {
+-	return memblock_is_map_memory(pfn << PAGE_SHIFT);
++	return memblock_is_memory(pfn << PAGE_SHIFT);
+ }
+ EXPORT_SYMBOL(pfn_valid);
+ #endif
+diff --git a/arch/arm64/mm/ioremap.c b/arch/arm64/mm/ioremap.c
+index 01e88c8bcab0..c17c220b0c48 100644
+--- a/arch/arm64/mm/ioremap.c
++++ b/arch/arm64/mm/ioremap.c
+@@ -21,6 +21,7 @@
+  */
+ 
+ #include <linux/export.h>
++#include <linux/memblock.h>
+ #include <linux/mm.h>
+ #include <linux/vmalloc.h>
+ #include <linux/io.h>
+@@ -55,7 +56,7 @@ static void __iomem *__ioremap_caller(phys_addr_t phys_addr, size_t size,
+ 	/*
+ 	 * Don't allow RAM to be mapped.
+ 	 */
+-	if (WARN_ON(pfn_valid(__phys_to_pfn(phys_addr))))
++	if (WARN_ON(memblock_is_map_memory(phys_addr)))
+ 		return NULL;
+ 
+ 	area = get_vm_area_caller(size, VM_IOREMAP, caller);
+@@ -96,7 +97,7 @@ EXPORT_SYMBOL(__iounmap);
+ void __iomem *ioremap_cache(phys_addr_t phys_addr, size_t size)
+ {
+ 	/* For normal memory we already have a cacheable mapping. */
+-	if (pfn_valid(__phys_to_pfn(phys_addr)))
++	if (memblock_is_map_memory(phys_addr))
+ 		return (void __iomem *)__phys_to_virt(phys_addr);
+ 
+ 	return __ioremap_caller(phys_addr, size, __pgprot(PROT_NORMAL),
diff --git a/gitrev b/gitrev
index 6ac3fc820..4be186a35 100644
--- a/gitrev
+++ b/gitrev
@@ -1 +1 @@
-0c183d92b20b5c84ca655b45ef57b3318b83eb9e
+577f12c07e4edd54730dc559a9c7bc44d22bf7dc
diff --git a/kernel.spec b/kernel.spec
index c07ddaaf0..a3d1f0909 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -77,7 +77,7 @@ Summary: The Linux kernel
 # The rc snapshot level
 %global rcrev 3
 # The git snapshot level
-%define gitrev 1
+%define gitrev 2
 # Set rpm version accordingly
 %define rpmversion 4.%{upstream_sublevel}.0
 %endif
@@ -527,6 +527,14 @@ Patch425: arm64-pcie-quirks.patch
 # http://www.spinics.net/lists/linux-tegra/msg26029.html
 Patch426: usb-phy-tegra-Add-38.4MHz-clock-table-entry.patch
 
+# Fix OMAP4 (pandaboard)
+Patch427: arm-revert-mmc-omap_hsmmc-Use-dma_request_chan-for-reque.patch
+Patch428: ARM-OMAP4-Fix-crashes.patch
+
+# Not particularly happy we don't yet have a proper upstream resolution this is the right direction
+# https://www.spinics.net/lists/arm-kernel/msg535191.html
+Patch429: arm64-mm-Fix-memmap-to-be-initialized-for-the-entire-section.patch
+
 # http://patchwork.ozlabs.org/patch/587554/
 Patch430: ARM-tegra-usb-no-reset.patch
 
@@ -625,9 +633,6 @@ Patch848: 0001-cpupower-Correct-return-type-of-cpu_power_is_cpu_onl.patch
 #ongoing complaint, full discussion delayed until ksummit/plumbers
 Patch849: 0001-iio-Use-event-header-from-kernel-tree.patch
 
-# CVE-2016-9083 CVE-2016-9084 rhbz 1389258 1389259 1389285
-Patch850: v3-vfio-pci-Fix-integer-overflows-bitmask-check.patch
-
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2169,6 +2174,13 @@ fi
 #
 #
 %changelog
+* Fri Nov 04 2016 Laura Abbott <labbott@redhat.com> - 4.9.0-0.rc3.git2.1
+- Linux v4.9-rc3-261-g577f12c
+
+* Wed Nov  2 2016 Peter Robinson <pbrobinson@fedoraproject.org>
+- Some OMAP4 fixes
+- ARM64 fix for NUMA
+
 * Tue Nov 01 2016 Laura Abbott <labbott@redhat.com> - 4.9.0-0.rc3.git1.1
 - Linux v4.9-rc3-243-g0c183d9
 
diff --git a/sources b/sources
index 41b6eecbd..29aa6a883 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
 c1af0afbd3df35c1ccdc7a5118cd2d07  linux-4.8.tar.xz
 0dad03f586e835d538d3e0d2cbdb9a28  perf-man-4.8.tar.gz
 bf2eeea112993a992434d0151b0e9db8  patch-4.9-rc3.xz
-e494de724a883883d2d99c87140c6208  patch-4.9-rc3-git1.xz
+036b044a6daa15a7dc463ffe5d1c390c  patch-4.9-rc3-git2.xz
diff --git a/v3-vfio-pci-Fix-integer-overflows-bitmask-check.patch b/v3-vfio-pci-Fix-integer-overflows-bitmask-check.patch
deleted file mode 100644
index 5278d4486..000000000
--- a/v3-vfio-pci-Fix-integer-overflows-bitmask-check.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From patchwork Wed Oct 12 16:51:24 2016
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 7bit
-Subject: [v3] vfio/pci: Fix integer overflows, bitmask check
-From: Vlad Tsyrklevich <vlad@tsyrklevich.net>
-X-Patchwork-Id: 9373631
-Message-Id: <1476291084-50737-1-git-send-email-vlad@tsyrklevich.net>
-To: kvm@vger.kernel.org
-Cc: alex.williamson@redhat.com, Vlad Tsyrklevich <vlad@tsyrklevich.net>
-Date: Wed, 12 Oct 2016 18:51:24 +0200
-
-The VFIO_DEVICE_SET_IRQS ioctl did not sufficiently sanitize
-user-supplied integers, potentially allowing memory corruption. This
-patch adds appropriate integer overflow checks, checks the range bounds
-for VFIO_IRQ_SET_DATA_NONE, and also verifies that only single element
-in the VFIO_IRQ_SET_DATA_TYPE_MASK bitmask is set.
-VFIO_IRQ_SET_ACTION_TYPE_MASK is already correctly checked later in
-vfio_pci_set_irqs_ioctl().
-
-Furthermore, a kzalloc is changed to a kcalloc because the use of a
-kzalloc with an integer multiplication allowed an integer overflow
-condition to be reached without this patch. kcalloc checks for overflow
-and should prevent a similar occurrence.
-
-Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
----
- drivers/vfio/pci/vfio_pci.c       | 33 +++++++++++++++++++++------------
- drivers/vfio/pci/vfio_pci_intrs.c |  2 +-
- 2 files changed, 22 insertions(+), 13 deletions(-)
-
-diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
-index d624a52..031bc08 100644
---- a/drivers/vfio/pci/vfio_pci.c
-+++ b/drivers/vfio/pci/vfio_pci.c
-@@ -829,8 +829,9 @@ static long vfio_pci_ioctl(void *device_data,
- 
- 	} else if (cmd == VFIO_DEVICE_SET_IRQS) {
- 		struct vfio_irq_set hdr;
-+		size_t size;
- 		u8 *data = NULL;
--		int ret = 0;
-+		int max, ret = 0;
- 
- 		minsz = offsetofend(struct vfio_irq_set, count);
- 
-@@ -838,23 +839,31 @@ static long vfio_pci_ioctl(void *device_data,
- 			return -EFAULT;
- 
- 		if (hdr.argsz < minsz || hdr.index >= VFIO_PCI_NUM_IRQS ||
-+		    hdr.count >= (U32_MAX - hdr.start) ||
- 		    hdr.flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK |
- 				  VFIO_IRQ_SET_ACTION_TYPE_MASK))
- 			return -EINVAL;
- 
--		if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
--			size_t size;
--			int max = vfio_pci_get_irq_count(vdev, hdr.index);
-+		max = vfio_pci_get_irq_count(vdev, hdr.index);
-+		if (hdr.start >= max || hdr.start + hdr.count > max)
-+			return -EINVAL;
- 
--			if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
--				size = sizeof(uint8_t);
--			else if (hdr.flags & VFIO_IRQ_SET_DATA_EVENTFD)
--				size = sizeof(int32_t);
--			else
--				return -EINVAL;
-+		switch (hdr.flags & VFIO_IRQ_SET_DATA_TYPE_MASK) {
-+		case VFIO_IRQ_SET_DATA_NONE:
-+			size = 0;
-+			break;
-+		case VFIO_IRQ_SET_DATA_BOOL:
-+			size = sizeof(uint8_t);
-+			break;
-+		case VFIO_IRQ_SET_DATA_EVENTFD:
-+			size = sizeof(int32_t);
-+			break;
-+		default:
-+			return -EINVAL;
-+		}
- 
--			if (hdr.argsz - minsz < hdr.count * size ||
--			    hdr.start >= max || hdr.start + hdr.count > max)
-+		if (size) {
-+			if (hdr.argsz - minsz < hdr.count * size)
- 				return -EINVAL;
- 
- 			data = memdup_user((void __user *)(arg + minsz),
-diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
-index c2e6089..1c46045 100644
---- a/drivers/vfio/pci/vfio_pci_intrs.c
-+++ b/drivers/vfio/pci/vfio_pci_intrs.c
-@@ -256,7 +256,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix)
- 	if (!is_irq_none(vdev))
- 		return -EINVAL;
- 
--	vdev->ctx = kzalloc(nvec * sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
-+	vdev->ctx = kcalloc(nvec, sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
- 	if (!vdev->ctx)
- 		return -ENOMEM;
-